3526c74a22a6a7ff285bddc4a055d22e443bd2d9ceb47aa7bc20240256084787

Submit
Reports

Overview

overview

Static

static

174ac08f7f...83.exe

windows7-x64

21697ff9c9...27.dll

windows7-x64

299baa160c...88.exe

windows7-x64

390f8ea304...a2.exe

windows7-x64

3d26ddb0a9...05.exe

windows7-x64

51308678ff...54.exe

windows7-x64

600db89be8...7f.exe

windows7-x64

6860173ca5...b1.dll

windows7-x64

6fd5bdcc62...34.exe

windows7-x64

87cee50a81...c7.exe

windows7-x64

93564e681c...ca.exe

windows7-x64

9c109b79da...97.exe

windows7-x64

9c8685a98f...7f.exe

windows7-x64

CrypMod.exe

windows7-x64

Fuck.exe

windows7-x64

Generic_Ransom_1.exe

windows7-x64

Genericcc.exe

windows7-x64

Gneeirc2.exe

windows7-x64

MyxaH.exe

windows7-x64

a1e86fc6cf...c2.exe

windows7-x64

add230a2e7...10.exe

windows7-x64

ae3a9c9cf9...b7.exe

windows7-x64

b878926219...be.exe

windows7-x64

c28384feb8...1a.exe

windows7-x64

cryptmod2.exe

windows7-x64

d041a11a04...a7.exe

windows7-x64

db3f0b9d66...0f.exe

windows7-x64

dcb283e040...ea.exe

windows7-x64

e54de5d857...f3.exe

windows7-x64

f14fd49537...19.exe

windows7-x64

f7ee55f157...ed.exe

windows7-x64

genenenrnenr.exe

windows7-x64

Analysis

max time kernel
1566s
max time network
1571s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 13:44

Sharing

Copy URL

Twitter E-mail

Static task

static1

aspackv2 upx 13 49 sodinokibi

5 signatures

Behavioral task

behavioral1

Sample

174ac08f7fd9c8486511122f2b8c730018c68d4492bf58840f7dbe5338072883.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral2

Sample

21697ff9c9b2ad4fb91d805cd139175a4ff8fbddf1fdff52c9dd8eee78612b27.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

1800 seconds

Behavioral task

behavioral3

Sample

299baa160cc77a615a22266ea21c1eabc357ade95901e569d82731ba44309f88.exe

Resource

win7-20240221-en

persistence

windows7-x64

8 signatures

1800 seconds

Behavioral task

behavioral4

Sample

390f8ea3044007611ebadad5352708aa3d0df0872b4550100f439a0aad7213a2.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral5

Sample

3d26ddb0a96c825ff98a6b6456bf52dab1a896da2a8690a041524a6c82213a05.exe

Resource

win7-20240221-en

modiloader persistence trojan upx

windows7-x64

6 signatures

1800 seconds

Behavioral task

behavioral6

Sample

51308678ff4559482f32fc2138d4134b412ab75977c19003bd6a7209b3c1cb54.exe

Resource

win7-20240220-en

persistence

windows7-x64

3 signatures

1800 seconds

Behavioral task

behavioral7

Sample

600db89be8dbd50e60c620ea147688cea7d512b1dc545a6b95fe41f0dfeca57f.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral8

Sample

6860173ca54b7e763cc667ac54435f1a18a821e09453b9e41556b6c2e9323eb1.dll

Resource

win7-20240215-en

windows7-x64

1 signatures

1800 seconds

Behavioral task

behavioral9

Sample

6fd5bdcc625d735f67f0ad4cacd06feb2ae20a2ec7626ff91fbd1848d1173d34.exe

Resource

win7-20240221-en

modiloader persistence trojan upx

windows7-x64

8 signatures

1800 seconds

Behavioral task

behavioral10

Sample

87cee50a81408e14f015d7507a87950e678742ba78015fd65d24f9934d22c9c7.exe

Resource

win7-20240221-en

persistence upx

windows7-x64

13 signatures

1800 seconds

Behavioral task

behavioral11

Sample

93564e681c3b63f14bfb67df98f5461917c447f343770a3a944ab251c4dac5ca.exe

Resource

win7-20240319-en

persistence upx

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral12

Sample

9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe

Resource

win7-20240221-en

evasion persistence

windows7-x64

6 signatures

1800 seconds

Behavioral task

behavioral13

Sample

9c8685a98f9be3a699ea95314449fd90fbaeac3e587efdfcb0c495621e7b087f.exe

Resource

win7-20240221-en

evasion persistence spyware stealer trojan upx

windows7-x64

26 signatures

1800 seconds

Behavioral task

behavioral14

Sample

CrypMod.exe

Resource

win7-20240215-en

gandcrab backdoor ransomware spyware stealer

windows7-x64

16 signatures

1800 seconds

Behavioral task

behavioral15

Sample

Fuck.exe

Resource

win7-20231129-en

gandcrab backdoor ransomware spyware stealer

windows7-x64

14 signatures

1800 seconds

Behavioral task

behavioral16

Sample

Generic_Ransom_1.exe

Resource

win7-20240220-en

persistence

windows7-x64

14 signatures

1800 seconds

Behavioral task

behavioral17

Sample

Genericcc.exe

Resource

win7-20240221-en

aspackv2 persistence

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral18

Sample

Gneeirc2.exe

Resource

win7-20240221-en

persistence ransomware spyware stealer

windows7-x64

20 signatures

1800 seconds

Behavioral task

behavioral19

Sample

MyxaH.exe

Resource

win7-20240221-en

netwire botnet rat stealer

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral20

Sample

a1e86fc6cfb129a978b7de1f8b773f766640e50874d8989999be2c55c6d022c2.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral21

Sample

add230a2e7aabf2ea909f641894d9febc6673cf23623a00ce3f47bc73ec9b310.exe

Resource

win7-20240221-en

sodinokibi ransomware

windows7-x64

11 signatures

1800 seconds

Behavioral task

behavioral22

Sample

ae3a9c9cf994b6f1967aee6a31f13796e0f59d4c2bd22865e24f2babf2043bb7.exe

Resource

win7-20240221-en

evasion persistence upx

windows7-x64

12 signatures

1800 seconds

Behavioral task

behavioral23

Sample

b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe

Resource

win7-20231129-en

upx

windows7-x64

4 signatures

1800 seconds

Behavioral task

behavioral24

Sample

c28384feb8d622682c10e81da44448c226638a7fed9b531ab7a5f652c55b3e1a.exe

Resource

win7-20240220-en

persistence upx

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral25

Sample

cryptmod2.exe

Resource

win7-20240221-en

gandcrab backdoor ransomware spyware stealer

windows7-x64

16 signatures

1800 seconds

Behavioral task

behavioral26

Sample

d041a11a04bba9142ee44712a53c8e94bccefeefe1d382ac35171518cd6b64a7.exe

Resource

win7-20240221-en

persistence upx

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral27

Sample

db3f0b9d66482afc1f2328f7eee8a8cc57ce03e19a4325e50d239203a4d17e0f.exe

Resource

win7-20240221-en

persistence

windows7-x64

5 signatures

1800 seconds

Behavioral task

behavioral28

Sample

dcb283e040d84bf1a86b381bfb0ce6b8dc070b58ba5d3150eed9cb7becf769ea.exe

Resource

win7-20240221-en

windows7-x64

4 signatures

1800 seconds

Behavioral task

behavioral29

Sample

e54de5d857ff16efd72ff0223235826494147444538f725f6977ca892282e7f3.exe

Resource

win7-20240215-en

persistence upx

windows7-x64

7 signatures

1800 seconds

Behavioral task

behavioral30

Sample

f14fd49537695f6e33bd102633b0737a2713df3197e36b7cdb176bc8683f6919.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral31

Sample

f7ee55f1571b1a082a8e61811811009b02e5b0d651bd7c3f8d29ca16ef1e14ed.exe

Resource

win7-20231129-en

windows7-x64

2 signatures

1800 seconds

Behavioral task

behavioral32

Sample

genenenrnenr.exe

Resource

win7-20240221-en

windows7-x64

3 signatures

1800 seconds

Report Analysis Logs

General

Target

21697ff9c9b2ad4fb91d805cd139175a4ff8fbddf1fdff52c9dd8eee78612b27.dll
Size

453KB
MD5

862cf65eca1cf1395e947222b6258fb8
SHA1

78872ba55112d4381a26543b87f2558b475fcf37
SHA256

21697ff9c9b2ad4fb91d805cd139175a4ff8fbddf1fdff52c9dd8eee78612b27
SHA512

e56ed23f230de3e879586d95de32f16c19b1dc26cae13e040c123290a7bb268563ccb9101ab81cdf9fdfc23bca6574230ed484f9914ae0b48ab5065d74ef1f01
SSDEEP

3072:a/Q5Y48JB8FmHTafIa+XiRKCPqp2Jda45+8BSf6/yEhA/a9rwV:2QwzFa+XigCPycda4U88f6/ywAi9k

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2740 wrote to memory of 2612	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 2612	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 2612	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 2612	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 2612	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 2612	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 2612	2740	rundll32.exe	rundll32.exe

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21697ff9c9b2ad4fb91d805cd139175a4ff8fbddf1fdff52c9dd8eee78612b27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21697ff9c9b2ad4fb91d805cd139175a4ff8fbddf1fdff52c9dd8eee78612b27.dll,#1
  2⤵
  PID:2612

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads