Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2024, 04:46

General

  • Target

    c7b96a1e4295583679d9767462523a88.exe

  • Size

    124KB

  • MD5

    c7b96a1e4295583679d9767462523a88

  • SHA1

    ba0db5388b1bf9ef9f0eae1515f39c46cd1ce66e

  • SHA256

    6adfa2cfe26d10030fa202b8c433e64097a6e5a0f521105022129009315e7fc7

  • SHA512

    e7f7ee2b66cb47a4eaba135addce78dc9d2fd170b8f344a98ae22e20975cb0fcc6409e52fda14fbac632556b9f4723e120e088e19abf9277f47c1f0fe5e1fcf1

  • SSDEEP

    1536:W+kZIgVtyYlf6YmW6TNbqRpMBwldzGJKgT3eJ6LOPuYyI1TS8VkwDF:ZkZIUtyYlQTNWnvlRGJKgTOJKOfHSF+

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7b96a1e4295583679d9767462523a88.exe
    "C:\Users\Admin\AppData\Local\Temp\c7b96a1e4295583679d9767462523a88.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Probi7.dll",Startup
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3124
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Probi7.dll",iep
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3144

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Probi7.dll

    Filesize

    124KB

    MD5

    5ed9c1221e3bac6fdc9cf29b9774ddc1

    SHA1

    28593f4065f10d6128214b60ffa780fb8098e060

    SHA256

    125399d549aa428ac578a3efefdcd8fb42fd98f2d3e76ed191e4226b52e76883

    SHA512

    3c566fba188de9eee462fb7bf3fb4c1d1f44fbabb97556c1bcc9554b44b8ec5f1471a9f9ef996f7894ee75b94530318794a4abd4d597a6590cb6b040b6e0ee7b

  • memory/2916-13-0x00000000023C0000-0x00000000023D0000-memory.dmp

    Filesize

    64KB

  • memory/2916-1-0x00000000023C0000-0x00000000023D0000-memory.dmp

    Filesize

    64KB

  • memory/2916-2-0x00000000023C0000-0x00000000023D0000-memory.dmp

    Filesize

    64KB

  • memory/2916-0-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/2916-14-0x00000000023C0000-0x00000000023D0000-memory.dmp

    Filesize

    64KB

  • memory/2916-9-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/3124-7-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/3124-10-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/3124-8-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/3124-19-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/3124-22-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/3144-20-0x00000000008D0000-0x00000000008E0000-memory.dmp

    Filesize

    64KB

  • memory/3144-21-0x00000000008D0000-0x00000000008E0000-memory.dmp

    Filesize

    64KB

  • memory/3144-23-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/3144-26-0x00000000008D0000-0x00000000008E0000-memory.dmp

    Filesize

    64KB

  • memory/3144-27-0x00000000008D0000-0x00000000008E0000-memory.dmp

    Filesize

    64KB