Analysis
-
max time kernel
118s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 20:43
Behavioral task
behavioral1
Sample
c99319e66df368ce8e34c71e95ce1d73.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c99319e66df368ce8e34c71e95ce1d73.exe
Resource
win10v2004-20240226-en
General
-
Target
c99319e66df368ce8e34c71e95ce1d73.exe
-
Size
19.2MB
-
MD5
c99319e66df368ce8e34c71e95ce1d73
-
SHA1
f9d71951e95a95150ea9cb274f48df164a2e9888
-
SHA256
2e3f87014996ded9d141e32232acea889a8091e2a0f731e0b59c27e067192dbd
-
SHA512
5d9038663f54d821285ae08d27d9de4c190ab567a7996a8ae08315eaf71a7de8200df90b20c29f024dfffc44d01e8437f7b31761d9d085474b3027b649c9f391
-
SSDEEP
393216:7zuRB2BrXj8Fixo39c5hlERblh2pN2WmfDZMTtN3ZWITMax8T9GDTzr:7zSUxiEhk5Qpg7itN3Nxdf
Malware Config
Signatures
-
Loads dropped DLL 47 IoCs
pid Process 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe 2932 c99319e66df368ce8e34c71e95ce1d73.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 2 discord.com 3 discord.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2932 c99319e66df368ce8e34c71e95ce1d73.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1224 wrote to memory of 2932 1224 c99319e66df368ce8e34c71e95ce1d73.exe 28 PID 1224 wrote to memory of 2932 1224 c99319e66df368ce8e34c71e95ce1d73.exe 28 PID 1224 wrote to memory of 2932 1224 c99319e66df368ce8e34c71e95ce1d73.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe"C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe"C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD58697c106593e93c11adc34faa483c4a0
SHA1cd080c51a97aa288ce6394d6c029c06ccb783790
SHA256ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
SHA512724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987
-
Filesize
84KB
MD5b89b6c064cd8241ae12addb7f376cab2
SHA129e86a1df404c442e14344042d39a98dd15425f7
SHA2560563df6e938b836f817c49e0cf9828cc251b2092a84273152ea5a7c537c03beb
SHA512f87b1c6d90cfb01316a17ad37f27287d5ef4ff3a0f7fd25303203ea7c7fa1ed12c1aef486dc9bbb8b4d527f37e771b950fa5142b2bac01f52afbfdbf7a77111d
-
Filesize
123KB
MD54d13a7b3ecc8c7dc96a0424c465d7251
SHA10c72f7259ac9108d956aede40b6fcdf3a3943cb5
SHA2562995ef03e784c68649fa7898979cbb2c1737f691348fae15f325d9fc524df8ed
SHA51268ff7c421007d63a970269089afb39c949d6cf9f4d56aff7e4e0b88d3c43cfaa352364c5326523386c00727cc36e64274a51b5dbb3a343b16201cf5fc264fec8
-
Filesize
140KB
MD5f5ed57bd28de184addaca5c8c3cd1ff8
SHA15c2dfa4ce62e831b0e74c2f164c64c439cb46c90
SHA256253942f60eab7962121d897826e785022e16a0e02614c3578f8b3a872ff608d0
SHA5123cabf04559665ac2adc576187c4eb2ad10c7386ee034cf77d5fec0828314e0d15decdebcf61903044436b7db87bf81bce5e51af459a3a2c059a187f23a8c69a9
-
Filesize
77KB
MD5eb974aeda30d7478bb800bb4c5fbc0a2
SHA1c5b7bc326bd003d42bcf620d657cac3f46f9d566
SHA2561db7b4f6ae31c4d35ef874eb328f735c96a2457677a3119e9544ee2a79bc1016
SHA512f9eea3636371ba508d563cf21541a21879ce50a5666e419ecfd74255c8decc3ae5e2ceb4a8f066ae519101dd71a116335a359e3343e8b2ff3884812099ae9b1b
-
Filesize
150KB
MD5fefbb91866778278460e16e44cfb8151
SHA153890f03a999078b70b921b104df198f2f481a7c
SHA2568a10b301294a35bc3a96a59ca434a628753a13d26de7c7cb51d37cf96c3bdbb5
SHA512449b5f0c089626db1824ebe405b97a67b073ea7ce22cee72aa3b2490136b3b6218e9f15d71da6fd32fba090255d3a0ba0e77a36c1f8b8bea45f6be95a91e388d
-
Filesize
11KB
MD51bab66681e21a40a87bd7b869154ea3e
SHA14cd8f6da8a269c9f92915e557018b660e9a67543
SHA25620560798f43a79ef390d9bc42aea3a59918c9440fb1404b420072b2048d77def
SHA5128d184572a31ad33d8350170c9d4ca3f7fdb2675bc8569d5a917b13da798ce4b3aaae231be81e5f09fbf98369b8769c71ebd1a128745bf2f9829230eee141d6b5
-
Filesize
11KB
MD51f061fd38e9e8717f1a6b9463929e9e2
SHA1332b69d41c480c89bfc3840e132754cb19643146
SHA256843a7cab04233f656081ddbeceeb58a7cdd2e2b1a04833f8acc4d361d2909abb
SHA512c1825476f8a1dc11cdee5511d367ff66657e86840a57984711ab09814af9f588fc4b16ce6e63e446bb7ea16de2fe1bfdc91e71fa42285e0934b655f1a22cb579
-
Filesize
13KB
MD5a9511d3c0f01d3855e6d66066287b270
SHA11adb59fad65559234978ddb1aa594954392756e9
SHA256e4d3c421dfcf3a68ecba5ad4edd6bf55fcbed486a1417af9beaa9a1d62fb7e2a
SHA512584ae6d9d7b55caad035ebca284e848ca4875dbb8e8626093b7764d66907410f5b6bb0ecbc8f52269041707e47e8fd5781f2be26118125ad6efc6365bdb4d253
-
Filesize
11KB
MD57ecd60a32b006faa9b2618182fdaf1a4
SHA1c6f8a363efd6a10abcb5b644ff49e26a0dd54c1a
SHA256647442d40ea1bda158ceef56e3ec3d2e66fff1702de469e9c2ff162f1bff6161
SHA512091029146cde34ce72916b5c090725962d63b53d1455aa96265cd3af98609994430dda2bc38f72a3aa8b2bd973680c83ff486d41c6ec0fa8a1cf43baef99bfc2
-
Filesize
11KB
MD5c45f1192763d4407778990a072b0dc74
SHA15b9f5813da5e76e87cf158ea610fbe6152a091bc
SHA256434a06fb89164aff7b18acaffb079ba074e4dae782ac005680395e052a28f30e
SHA512c1c68dd4b3418d37aeb074557cce2ff5c7330679f53cd5e1af8e92c90c7cf954538373a3cabb505d160ff68c0762acd5f8ef901046bab7ec70e44de3c8160988
-
Filesize
12KB
MD5833b2f70c9678b56133d69c2e4b67514
SHA17ff8544e56dda0dfccce716511bb9eb0e5cf9822
SHA2563828e4a7a4ede679807577df73db4561469a5757bad52f241508ca84b3cbcdc7
SHA512df0e0ae4ec65be16a725003abb7605f5a7fdc5e4c087bbb5d6dc57636aa47dc3042dcd01cd277d770b5781878bdb4955b945e244dea4fd7c9be8ca9532c0fb5c
-
Filesize
15KB
MD5f789e3383d73aa3fa3c35cebe27a6fe6
SHA13b887ab640181e350b78e30818e1b47c9c1ff11c
SHA25660c3428168002b09fdc246cf948c8341c3b2a1a0e1f70cedcdd6eab59b8e2d08
SHA512fd10635929e7598f05174fa3617fdb828547687898248376760c294570665c552d6e58215b9ea68b99ff5483c8657bb041cfdc9ed92cc0cfc1be7736eafb2b9d
-
Filesize
11KB
MD5673bec1368a19fa839cc77492ebe1c98
SHA1c87c250ce43d760f4f07ffca2f4dabbbbe90edea
SHA25663077ff3b5315688ed1ada38d05b15a713921e862a34ffc9260f30d3fd00cc7d
SHA51252424b7746833934ec2c1b0b61246324a1c5cba164fd2f29562c6bde13333ddfb72907cd9107e72b7d7f5cf34ebb52a9b95eb37bb27dbce5cf234badee02a765
-
Filesize
13KB
MD5ab3369337c192d0ae9306af0ad030cef
SHA150577bf4eab40dd9ed9bd163ead95a0ea72b9597
SHA256918411e05e727e6d42fe19b37c878d5ea461dc86f3bb8c21652c46d0088de8b4
SHA51297a9426cf286b486cfa046867bf06e0458af2625634bd19786e69c9e6e42722f37cd4de8089033f5eaaa9d0baa835bf4e3d180bb0da3f6ba221c34bd75d141b8
-
Filesize
11KB
MD566345ba9fae2de5be6dad2f2cb2c263d
SHA152d178ac3710f3bc622832c7b6ecb3682c340267
SHA25613c9432b4e54ba7699c062f5f20fcfa083e77059b7b6bc33db2cef5767d49227
SHA512a4db4fa07329d26d91f432d1c7726295a82f9cd6c21685cf190399db4a54bf38005d4041cbe6f9676bb264065602d7f0cb1f81d59a703ac994b6ba1c57f0ddf8
-
Filesize
11KB
MD5c8cb7df56c4e4c6b461cd7535c34dd3e
SHA1881e0c16579e86d0f3def8fed98af64ba1ff6f2c
SHA256de95bf6ecffb6aeb31bba8f62bb282f87e4b5b19659eca4b2435b2be2999c9c8
SHA51219c354ee6d7645bf141889ce63467b3884ffdfd2964c7a873a80ec9fd10ed324b961869b0d06eafe222e7a064b77a8d7515b5c841872876ec19aa12dafea8b0d
-
Filesize
20KB
MD53c76c9213112a111275ed5daf7b20a1e
SHA1a9c2b0619c46c975637f1e0c4b80be7155fb158c
SHA2567a75c4c14da9f0e6d9c597321ee3a6531f903bbce33b83259eca611f62877c60
SHA512a058a5eeb3d8710aeb0098eb2b9f637cbe54631fc775dd5e054c99c018d3d91eb1d4561acc15c2bff8a2fd0900e0b85d0371768d56f46344f55982e9c837c7b3
-
Filesize
12KB
MD5f4fa9e3d84e97b0f1f31c2c57ded56d1
SHA12a2cd7d6539e0f5913257f67e9a2ecbea974811f
SHA2561c8b9cfecb68e60c151ebb2a305291e70b7584faefd8c02df331b3713f11c5f6
SHA5129a18c121b48c7364b66631c0c730abd9044849be372932cbae352ae45dca1766d45afa4ad68048dad5a11407d04e059408a49d9fb46328b5e3bcce633efb5178
-
Filesize
15KB
MD5bf0c335428a9bdd676d726199dc9e517
SHA1f9ef3ae33686176ec542f870da6c092b5c21c0cf
SHA2564c93b20d7f2ccedc725f3f718f24e23d6a2148f0d73ea1d032c2eeba6b16afb0
SHA512feecbd04acad88bc1a352c5ddfeff34acacf5c88b6ab3143692305378b1cb7b6204bfc8cd84abbc56c3ab279f39d1e75e3fe6904216d818de0a28b801a7c0928
-
Filesize
17KB
MD5a6d215393c7498005368b636ce8ac831
SHA1b5b7ca683ab0736644a3fe9e51714b3d358d5adf
SHA25612f0707c435d734fdec382b3475019b86e724902197b234a9788d9d6cb1e200c
SHA5126c929ad71e4b1b7d92b692ba7faf9b16e66035bde6b1c2d53885badd3c65429a2c8c379be15a3f14e97ff00c05400eb4b4083d7955bc984b662c78fc5ac5f693
-
Filesize
17KB
MD5839e3484564f9141c7f047e336b84930
SHA1dd03d279120ef382af0413c36fd4c58129a1e0c4
SHA2564e07911d2d2bf39b8b5ccabe1427f094b8feb3e0e5a5a691c4533d3bf5e58d56
SHA512dcc79e6f19a3bae6e83144cf466268e0c7f8ce22de5a6561c3df2cd536daa640282541e8943cf3b93d93610e97c52cd4f1a32febbe21828e03453de571537bc5
-
Filesize
13KB
MD54a991ee39fc196089364ec5a22dc9dce
SHA1f121bc9ade49b8e1a57ea681ea2e18d40136f01d
SHA256c3e1514c2e4d12ca10581dd4ac16ccc9ed055ea408b6c47a7eaaa32432652315
SHA5122f5f8b8ea0bee4792f90110dfef3c553b7d322618e3534227edd395510c10e5ef346ad06e340f519ef69e20302eac12e6144889ce733ce923134501ebfb2fbaa
-
Filesize
11KB
MD5bd2a0d3099e6f4dcc788d8e7d47095d2
SHA157ac6d00f21e9d7377157d9f5935b9cf27454f9d
SHA2564f199489614cf260c71242ba85c948b7a7d021d4a2295298aeb937e0f3b65682
SHA5121eb57e28010acb4cfd06b219d64efcec2dde6f80bb1e6cffdab3ce31b5c5000588c8a08daf4c7a6f44f0e6d6f71443f0cf87833b5cbb173e6900d9a20a6720d4
-
Filesize
759KB
MD5df8b8c969ff2b6f8bb7366501364edea
SHA1abe794715ba88790786c171625db7547f6f7dbac
SHA2566cb8ff9586c8511e415b08fb2ea329c66eb4e19c345a951b29781f8bf6de3b08
SHA51280415fce07ddc2bd4ccad95b9d4899ee7745a5f001880e72f8eee80eca884ed432a9dcbf1301cf193e09f89d74393469cdd7e2d5eca89b77e40b98323cbf5a3b
-
Filesize
3.2MB
MD5cc4cbf715966cdcad95a1e6c95592b3d
SHA1d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA5123b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
673KB
MD5bc778f33480148efa5d62b2ec85aaa7d
SHA1b1ec87cbd8bc4398c6ebb26549961c8aab53d855
SHA2569d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
SHA51280c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173
-
Filesize
4.0MB
MD53cd1e87aeb3d0037d52c8e51030e1084
SHA149ecd5f6a55f26b0fb3aeb4929868b93cc4ec8af
SHA25613f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8
SHA512497e48a379885fdd69a770012e31cd2a62536953e317bb28e3a50fdb177e202f8869ea58fc11802909cabb0552d8c8850537e9fb4ead7dd14a99f67283182340
-
Filesize
560KB
MD5efd05544ac3a7f0c7e38223004c1b81a
SHA12973a5c4d2d118fe66b6591455a90c33811ef3cd
SHA256b46daa6b63e2dde217ed2ec1da6dbd9256df1549d8ad306efcd3b4c4b0843a5b
SHA5123a25385ace2ca903df5bf9e04befdefa84fc325c53c379bf658df8033ac07bbf1a4ae7d216b77bb6b1f94bd8f99417d5d052d89f63f80250fb7cc6a91a05ba4a
-
Filesize
141KB
MD5d273b6494c4761536d6eef26e01956f1
SHA1a6e65c6745a593a23b20cbe9b8ba3414e46e50bb
SHA25628680409fd1ff08f87936f920b6bfa6ddc6ac8cd13fd3079e5600909cef5d0f6
SHA51265db50b36c8b1d1285e1659e1a67dd02329eac330192609a247057b535053571251f450865a9ccf3c86f23d2017b6950d68108c7171bf840f07958b39a034ae5
-
Filesize
132KB
MD5701d49790343f77b9cc78033f47772b7
SHA17f9031b27c30fe9b5a7432bd92505bcd5fcaf600
SHA256e10d19b35b220abf718bee0de4bf59ffa27d1b068c837934b3d5ba36329b8257
SHA512c15e89bcd6e9bd12d31514b1110a6347c0fc1809c6dfeb711f08a7ca51d19b3a7db856f0e1240d953bc8316f2066bbe1f012f588a7a925f98d29a991f8c40620
-
Filesize
158KB
MD56e396653552d446c8114e98e5e195d09
SHA1c1f760617f7f640d6f84074d6d5218d5a338a6ec
SHA2565ddba137db772b61d4765c45b6156b2ee33a1771ddd52dd55b0ef592535785cf
SHA512c4bf2c4c51350b9142da3faeadf72f94994e614f9e43e3c2a1675aa128c6e7f1212fd388a71124971648488bb718ca9b66452e5d0d0b840a0979df7146ed7ae5
-
Filesize
3.9MB
MD59e6a496933f79f43884689b4fe8d7b08
SHA1c8e62d761f073078dbc4505ac75eba0d21bb7fe8
SHA25635d50cad3da8583769cc4e44b17f113f5c6bd227d02adee999f04c28ac7c5d6f
SHA5120b6e0b19e6aaf575a3f6ac0fcb75523645f9a0413628cf284f9548a1bfe38abb00ee0e2883de00599a09917855f57c24a2415e82baaa3dd1301b56457df54789
-
Filesize
971KB
MD5bd8b198c3210b885fe516500306a4fcf
SHA128762cb66003587be1a59c2668d2300fce300c2d
SHA256ce2621719f1358508c2c33bcc1380d78a737ca20cd18c0ac89f38e1be788d9a2
SHA512c32b6c083d3a7da01085718e5685e9a04034be91251c065794ceef1dfaaf6573fdd845cbc84e926ab3f510d295649cb6e497564fbe52cc79c053357c645c11a5