b5f572622e992d1b6bc551a5de08e67d4cbbfe9d683429c7d98f4722311538d3

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2d1012eef77d03d5a4bd270aa36f782.exe
Size

343KB
MD5

c2d1012eef77d03d5a4bd270aa36f782
SHA1

3e31bd51c2744f4793fe5d780927cac627afe6d0
SHA256

b5f572622e992d1b6bc551a5de08e67d4cbbfe9d683429c7d98f4722311538d3
SHA512

6e015f3c49126b7085b0da291e3a9296a220a2f1c2f6da9fb2aa18c5ffc42c09a9ba9121bb6abb73335c34671081d70f4d04c92ba08334bb5c5bceda92ebf829
SSDEEP

6144:iEiDBF2idZecnl20lHRxp3g2ncduD7yB9VCO6Sco4q8+dE6CqmQw:iEyF3Z4mxxRDqVTVOCmd

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2908	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2212	servet.exe

Loads dropped DLL 2 IoCs

pid	Process
1736	c2d1012eef77d03d5a4bd270aa36f782.exe
1736	c2d1012eef77d03d5a4bd270aa36f782.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\servet.exe	c2d1012eef77d03d5a4bd270aa36f782.exe
File opened for modification	C:\Windows\SysWOW64\servet.exe	servet.exe
File created	C:\Windows\SysWOW64\Deledomn.bat	c2d1012eef77d03d5a4bd270aa36f782.exe
File created	C:\Windows\SysWOW64\servet.exe	c2d1012eef77d03d5a4bd270aa36f782.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2212	1736	c2d1012eef77d03d5a4bd270aa36f782.exe	28
PID 1736 wrote to memory of 2212	1736	c2d1012eef77d03d5a4bd270aa36f782.exe	28
PID 1736 wrote to memory of 2212	1736	c2d1012eef77d03d5a4bd270aa36f782.exe	28
PID 1736 wrote to memory of 2212	1736	c2d1012eef77d03d5a4bd270aa36f782.exe	28
PID 1736 wrote to memory of 2908	1736	c2d1012eef77d03d5a4bd270aa36f782.exe	29
PID 1736 wrote to memory of 2908	1736	c2d1012eef77d03d5a4bd270aa36f782.exe	29
PID 1736 wrote to memory of 2908	1736	c2d1012eef77d03d5a4bd270aa36f782.exe	29
PID 1736 wrote to memory of 2908	1736	c2d1012eef77d03d5a4bd270aa36f782.exe	29

C:\Users\Admin\AppData\Local\Temp\c2d1012eef77d03d5a4bd270aa36f782.exe
"C:\Users\Admin\AppData\Local\Temp\c2d1012eef77d03d5a4bd270aa36f782.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\servet.exe
  C:\Windows\system32\servet.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\Deledomn.bat
  2⤵
  - Deletes itself
  PID:2908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Deledomn.bat

Filesize
184B

MD5
3490cbbc442d4f827dfae32244d68542

SHA1
5b70fe3bb5455749f273aa5fec461d2a75290565

SHA256
c7955bec38be129f8cfa545ecbd75c2c2a9e1565888982db1611ebc0d1bb170a

SHA512
4b030d431e23b409b553a64d6e176dfa9567e9c224f678138b9855a40cbd6ed2a333d5b1165c59e5ba405a4e906254d22ed96de28be9e12e6a0073f3f1a1cfdd

Download Submit
\Windows\SysWOW64\servet.exe

Filesize
343KB

MD5
c2d1012eef77d03d5a4bd270aa36f782

SHA1
3e31bd51c2744f4793fe5d780927cac627afe6d0

SHA256
b5f572622e992d1b6bc551a5de08e67d4cbbfe9d683429c7d98f4722311538d3

SHA512
6e015f3c49126b7085b0da291e3a9296a220a2f1c2f6da9fb2aa18c5ffc42c09a9ba9121bb6abb73335c34671081d70f4d04c92ba08334bb5c5bceda92ebf829

Download Submit
memory/1736-2-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

Filesize
4KB

Download
memory/1736-4-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/1736-12-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/1736-11-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/1736-10-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/1736-9-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/1736-8-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/1736-16-0x0000000003A50000-0x0000000003AB3000-memory.dmp

Filesize
396KB

Download
memory/1736-14-0x0000000003180000-0x0000000003182000-memory.dmp

Filesize
8KB

Download
memory/1736-3-0x0000000001E80000-0x0000000001E81000-memory.dmp

Filesize
4KB

Download
memory/1736-13-0x0000000003190000-0x0000000003191000-memory.dmp

Filesize
4KB

Download
memory/1736-0-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1736-7-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download
memory/1736-38-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/1736-1-0x0000000000290000-0x00000000002E4000-memory.dmp

Filesize
336KB

Download
memory/1736-39-0x0000000000290000-0x00000000002E4000-memory.dmp

Filesize
336KB

Download
memory/1736-35-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/1736-37-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2212-36-0x0000000000290000-0x00000000002E4000-memory.dmp

Filesize
336KB

Download
memory/2212-27-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2212-25-0x0000000003190000-0x0000000003191000-memory.dmp

Filesize
4KB

Download
memory/2212-23-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2212-24-0x0000000000290000-0x00000000002E4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads