Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 20:43
Behavioral task
behavioral1
Sample
c99319e66df368ce8e34c71e95ce1d73.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c99319e66df368ce8e34c71e95ce1d73.exe
Resource
win10v2004-20240226-en
General
-
Target
c99319e66df368ce8e34c71e95ce1d73.exe
-
Size
19.2MB
-
MD5
c99319e66df368ce8e34c71e95ce1d73
-
SHA1
f9d71951e95a95150ea9cb274f48df164a2e9888
-
SHA256
2e3f87014996ded9d141e32232acea889a8091e2a0f731e0b59c27e067192dbd
-
SHA512
5d9038663f54d821285ae08d27d9de4c190ab567a7996a8ae08315eaf71a7de8200df90b20c29f024dfffc44d01e8437f7b31761d9d085474b3027b649c9f391
-
SSDEEP
393216:7zuRB2BrXj8Fixo39c5hlERblh2pN2WmfDZMTtN3ZWITMax8T9GDTzr:7zSUxiEhk5Qpg7itN3Nxdf
Malware Config
Signatures
-
Loads dropped DLL 30 IoCs
pid Process 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe 4112 c99319e66df368ce8e34c71e95ce1d73.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 15 discord.com 16 discord.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4112 c99319e66df368ce8e34c71e95ce1d73.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 180 wrote to memory of 4112 180 c99319e66df368ce8e34c71e95ce1d73.exe 91 PID 180 wrote to memory of 4112 180 c99319e66df368ce8e34c71e95ce1d73.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe"C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:180 -
C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe"C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5e5420478f4629aa0c01155efb1cae720
SHA1aadc68186f91bd60a25d40a73d58f2d75814e7d8
SHA2561a23796bd4255c8cd3d4229e8647d93605302ab603f180540be066afd20225b6
SHA5123d21bb88b34083420e5455bd57c384e54f219bbb621e2fbb0f9928ccccab07efb3cb647e9931c70c555d1cef99196ab6c28bb48c7b4d26e39650b821c0dc6a8b
-
Filesize
99KB
MD58697c106593e93c11adc34faa483c4a0
SHA1cd080c51a97aa288ce6394d6c029c06ccb783790
SHA256ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
SHA512724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987
-
Filesize
62KB
MD58cf9a316051bfc50f6dc343128b9c4e0
SHA13659ba74d2bc5b7d7ee806b95af71ec4dec76c13
SHA256f934719bea056a98446e786de88cda8f76afe9a29e67121950b17caafc2799c8
SHA512ad0e1fbf6744ae6d58768301e5ddc93eb2bf24f33bc49588097a03af915d51b296d815a36d9eefd671701289802075b1c850e8a5f4f453a81f0d53b28e65d6ae
-
Filesize
84KB
MD5b89b6c064cd8241ae12addb7f376cab2
SHA129e86a1df404c442e14344042d39a98dd15425f7
SHA2560563df6e938b836f817c49e0cf9828cc251b2092a84273152ea5a7c537c03beb
SHA512f87b1c6d90cfb01316a17ad37f27287d5ef4ff3a0f7fd25303203ea7c7fa1ed12c1aef486dc9bbb8b4d527f37e771b950fa5142b2bac01f52afbfdbf7a77111d
-
Filesize
123KB
MD54d13a7b3ecc8c7dc96a0424c465d7251
SHA10c72f7259ac9108d956aede40b6fcdf3a3943cb5
SHA2562995ef03e784c68649fa7898979cbb2c1737f691348fae15f325d9fc524df8ed
SHA51268ff7c421007d63a970269089afb39c949d6cf9f4d56aff7e4e0b88d3c43cfaa352364c5326523386c00727cc36e64274a51b5dbb3a343b16201cf5fc264fec8
-
Filesize
261KB
MD53e9395dc60b342fa529c2c805369977d
SHA1174286c9c838d1983f13047e0bfa7d611259daa9
SHA2569ebbf65d4f40d392b70631b6b5bf4c6384fa40ba7647c618f2832c874b7e7516
SHA5124768f06e00f0df59168d776dde837156cb030e0635d10067aa83171f91c93d158d72084af1e2e914ed75b1d885b752290582980da468a4d3cf07ebcb1a02e4c1
-
Filesize
45KB
MD5496cde3c381c8e33186354631dfad0f1
SHA1cbdb280ecb54469fd1987b9eff666d519e20249f
SHA256f9548e3b71764ac99efb988e4daac249e300eb629c58d2a341b753299180c679
SHA512f7245eb24f2b6d8bc22f876d6abb90e77db46bf0e5ab367f2e02e4ca936c898a5a14d843235adc5502f6d74715da0b93d86222e8dec592ae41ab59d56432bf4f
-
Filesize
158KB
MD56e396653552d446c8114e98e5e195d09
SHA1c1f760617f7f640d6f84074d6d5218d5a338a6ec
SHA2565ddba137db772b61d4765c45b6156b2ee33a1771ddd52dd55b0ef592535785cf
SHA512c4bf2c4c51350b9142da3faeadf72f94994e614f9e43e3c2a1675aa128c6e7f1212fd388a71124971648488bb718ca9b66452e5d0d0b840a0979df7146ed7ae5
-
Filesize
44KB
MD5724c5f1347a77318bdfa4942a71ffdfd
SHA1a284eeca1d336e9148de2a69d3728971b6cfa43e
SHA25603ef0f32653e78901649b3207340c914786e0455369412ca160d76f553f81faa
SHA51221463a489524eae93c4b734a56e07096a5620e48946d6c459e0ac5e451bf397130f022e4c5d8e26a5a9880d250a5d7ee0e4f508d66a174efb08d870c62a2d497
-
Filesize
27KB
MD51707a6aeeb0278ee445e86ee4354c86c
SHA150c30823b1dc995a03f5989c774d6541e5eaaef9
SHA256dd8c39ff48de02f3f74256a61bf3d9d7e411c051dd4205ca51446b909458f0cd
SHA512404b99b8c70de1d5e6a4f747df44f514a4b6480b6c30b468f35e9e0257fd75c1a480641bc88180f6eb50f0bd96bdcafb65bb25364c0757a6e601090ae5989838
-
Filesize
77KB
MD5eb974aeda30d7478bb800bb4c5fbc0a2
SHA1c5b7bc326bd003d42bcf620d657cac3f46f9d566
SHA2561db7b4f6ae31c4d35ef874eb328f735c96a2457677a3119e9544ee2a79bc1016
SHA512f9eea3636371ba508d563cf21541a21879ce50a5666e419ecfd74255c8decc3ae5e2ceb4a8f066ae519101dd71a116335a359e3343e8b2ff3884812099ae9b1b
-
Filesize
150KB
MD5fefbb91866778278460e16e44cfb8151
SHA153890f03a999078b70b921b104df198f2f481a7c
SHA2568a10b301294a35bc3a96a59ca434a628753a13d26de7c7cb51d37cf96c3bdbb5
SHA512449b5f0c089626db1824ebe405b97a67b073ea7ce22cee72aa3b2490136b3b6218e9f15d71da6fd32fba090255d3a0ba0e77a36c1f8b8bea45f6be95a91e388d
-
Filesize
62KB
MD5fc8a220585322021416cfc4bce9a9697
SHA176c9ab2cc8ae23e091baf4ae52a5ff1d0668a683
SHA2565440e7d58e44d2cca5764b6e282da61c63990b5ef116d3c728909d55104a09a7
SHA512c11785ac0b34492d69b45da3d3e489d819be28ff0f34f00bb6825934b74f94cdbe2f548eddd9c5d54dbba5f2664835b56323dc2d8159f04beb1552c072e96e4d
-
Filesize
47KB
MD55bf893cde770aa22603f7d2ac1371c0d
SHA141f75dfa82550c84acc0e0efec53a921140842d3
SHA2567ca04ff9661acf7bffcb3e557b0d82f12574c499d2c5b213d92b77afc43e17be
SHA512c79d41b568ef52bcfe2555f1a6dd74ae8251dd984ecb03b9ecc35a8e2c8f84f2cd994d156b1df81a823c8f7fb1446989cc60182fb2b382ee217be258d52d9c16
-
Filesize
232KB
MD5ac91ecd48574ce412e8e4d485df4ec77
SHA1676a9bcf343e13e925f86cc6ae3dcb37e12885e8
SHA256886115744bbd68d7d1406f8ce3bd8a6c51d86bd6c7ed760a8540baad9112ea4b
SHA5128b11b6b403d0ebc9736dd2927a6318261cc626509a8b1ef946b89a81d0e9e8b1c9f05444a8d2ed6076c5cec9c38e9f03bb3d0e7ead7c871252c77b951dcb8498
-
Filesize
41KB
MD5cdd7e78befd976319921ad58e871b026
SHA128b56d22e52cd2842504ea999a17c96e075313c9
SHA256ad13169f77b799492f4051158997bdf9bca5a52eb1c834e9b385c60cc5619dcb
SHA5121ba3ee6f535cfb67c9ea618db2841c1afa99a2893f93a240e28f57a5f225a868653bcb929077ff9eb42e7733c1320663d009e6bca70883ee857ab721943f0e19
-
Filesize
28KB
MD59a6c957ffd7186ad86bdf823a416975e
SHA1b269925b19f7c4b87bc2f2eecbc17d981c7ef98d
SHA2569723dd25eff1cbf3d5d2da25604a2bebacd2476b38c2872aeaf3b6a3403a584e
SHA5126e35dbed54a68f33999a20e18715d44420c3a21f05f85b0f465f3275729047335759467e16f9d757b1ea166e4736df98bea56cb58b7721d36f70e7d7f9872466
-
Filesize
759KB
MD5df8b8c969ff2b6f8bb7366501364edea
SHA1abe794715ba88790786c171625db7547f6f7dbac
SHA2566cb8ff9586c8511e415b08fb2ea329c66eb4e19c345a951b29781f8bf6de3b08
SHA51280415fce07ddc2bd4ccad95b9d4899ee7745a5f001880e72f8eee80eca884ed432a9dcbf1301cf193e09f89d74393469cdd7e2d5eca89b77e40b98323cbf5a3b
-
Filesize
253KB
MD53dcd08b803fbb28231e18b5d1eef4258
SHA1b81ea40b943cd8a0c341f3a13e5bc05090b5a72a
SHA256de2fa17c4d8ae68dc204a1b6b58b7a7a12569367cfeb8a3a4e1f377c73e83e9e
SHA5129cc7106e921fbcf8c56745b38051a5a56154c600e3c553f2e64d93ec988c88b17f6d49698bdc18e3aa57ae96a79ee2c08c584c7c4c91cc6ea72db3dca6ccc2f5
-
Filesize
3.2MB
MD5cc4cbf715966cdcad95a1e6c95592b3d
SHA1d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA5123b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
673KB
MD5bc778f33480148efa5d62b2ec85aaa7d
SHA1b1ec87cbd8bc4398c6ebb26549961c8aab53d855
SHA2569d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
SHA51280c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173
-
Filesize
43KB
MD5c43c2103add8c6c30f25b9e46e086147
SHA17a04d0dafcbe1036033c99d3e796422cba382796
SHA256d31834c5ba38b1654ccecdad6423d2c15fe58593f2dfba291ca0753e5ad2f8ce
SHA512b1d4f101543b1788c0e6137ff8c32b362082174618dc0ef888c692bde0fa54c182e4e2d8b7137e7cb20c1621336bc388aff6f88015ce4714c11254c10462e9bc
-
Filesize
76KB
MD581467ae2ccfd303b3ae249b271d02393
SHA1025316c0ffd42bb6085731596b5e5cf36a2ee400
SHA256b8dfb9df359c67334c017a8bdcad257e4ed5ef1637761acf40d19c4df040f8e1
SHA5123d4f02a97298d894e351514c9d719730b7de4baace38fcf395275bdde399158d35d10533a5ae762c24b748594e64109112a8d88f1b76b15beb2af47bc7db272e
-
Filesize
576KB
MD525882c6bcfee23c5511efd16a7f73cf6
SHA1c8da7e56db5e156ad2a21f4c2198ebaba2e4c9b3
SHA256326f262ef703bc0fe6c8d258023f33711a87745c537fa547ecc886cbb89139b1
SHA51261778bad564932dc63eff73992c39c49c5bf600f282d621137ec3355193a5fd1ef000c70b959a015fdc1757627558c19ce365e794a1eb472948d9aeeaa57e621
-
Filesize
4.0MB
MD53cd1e87aeb3d0037d52c8e51030e1084
SHA149ecd5f6a55f26b0fb3aeb4929868b93cc4ec8af
SHA25613f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8
SHA512497e48a379885fdd69a770012e31cd2a62536953e317bb28e3a50fdb177e202f8869ea58fc11802909cabb0552d8c8850537e9fb4ead7dd14a99f67283182340
-
Filesize
560KB
MD5efd05544ac3a7f0c7e38223004c1b81a
SHA12973a5c4d2d118fe66b6591455a90c33811ef3cd
SHA256b46daa6b63e2dde217ed2ec1da6dbd9256df1549d8ad306efcd3b4c4b0843a5b
SHA5123a25385ace2ca903df5bf9e04befdefa84fc325c53c379bf658df8033ac07bbf1a4ae7d216b77bb6b1f94bd8f99417d5d052d89f63f80250fb7cc6a91a05ba4a
-
Filesize
141KB
MD5d273b6494c4761536d6eef26e01956f1
SHA1a6e65c6745a593a23b20cbe9b8ba3414e46e50bb
SHA25628680409fd1ff08f87936f920b6bfa6ddc6ac8cd13fd3079e5600909cef5d0f6
SHA51265db50b36c8b1d1285e1659e1a67dd02329eac330192609a247057b535053571251f450865a9ccf3c86f23d2017b6950d68108c7171bf840f07958b39a034ae5
-
Filesize
26KB
MD508b499ae297c5579ba05ea87c31aff5b
SHA14a1a9f1bf41c284e9c5a822f7d018f8edc461422
SHA256940fb90fd78b5be4d72279dcf9c24a8b1fcf73999f39909980b12565a7921281
SHA512ab26f4f80449aa9cc24e68344fc89aeb25d5ba5aae15aeed59a804216825818edfe31c7fda837a93a6db4068ccfb1cc7e99173a80bd9dda33bfb2d3b5937d7e9
-
Filesize
192KB
MD51638852c4ce63769de89cad6c0083761
SHA155f927642e98e53d154f695819fb5cb4cb8f8dda
SHA2561f3a8b73d38aa3b23cf75583ba1f389adfc8e444be1dc6fcd30be80771e6d214
SHA512cfb2f8a757c9654b258fe94ea176b5d70294bc14295d7f7b4ba59163b6f56521c37b22724d4bbb37007995e288c99ee4689d9330d55031837cafd9f1b7221e2d
-
Filesize
704KB
MD50b811d973e6dc3f080ef3c86a1a5df36
SHA1052be9b5680b81a296c716bb884aeb0b0589c6c9
SHA2560a5dda64e735b1d638e3c6a31fb899a5ca09c4552ca9ccc0549ab4b9a9acb178
SHA51219a34d79bacfe6024d92c706c4b3142287c5f9e19d75476c5466e8030590ccd57aa0da3811063f8ba9d96c8744dcd2a619bdeb990545eb79dee6c4c84ed0e4ed
-
Filesize
1.0MB
MD584fb421643cab316ce623aa84395a950
SHA14fba083864b3811b8a09644d559186ecb347c387
SHA2565578c3054f8846be86e686fb73b62b1f931d3ed1a7859b87925a96774371dba4
SHA512a2132f93b0e4292dc9c32da2a6478769ec4f58be5c36ee2701e2a66154ea1dc2c0684fc7698e7c3ac04f5c1d366cb9633a9366e5a38b7ff7a964ff25ea266f9f
-
Filesize
132KB
MD5701d49790343f77b9cc78033f47772b7
SHA17f9031b27c30fe9b5a7432bd92505bcd5fcaf600
SHA256e10d19b35b220abf718bee0de4bf59ffa27d1b068c837934b3d5ba36329b8257
SHA512c15e89bcd6e9bd12d31514b1110a6347c0fc1809c6dfeb711f08a7ca51d19b3a7db856f0e1240d953bc8316f2066bbe1f012f588a7a925f98d29a991f8c40620
-
Filesize
78KB
MD5e96e99fc84249de9c4cd4649f3a27f7b
SHA14fcf885311d24a2ce438842bb7db269550709a00
SHA2563730432069213e61d347d65be318c32a81dfebc56397de6a900c0b71f2aea303
SHA51219aa039867085a5bba72308f514a614ba4703cc1299d6367b20d6ae7573f44a944f4ab46e3ea751e8a7bc63ebb97bf4fd32e60c480f31c4f9ff425725b690f79