Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
30-03-2024 11:45
Behavioral task
behavioral1
Sample
svhost.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
svhost.exe
Resource
win10v2004-20231215-en
General
-
Target
svhost.exe
-
Size
7.3MB
-
MD5
b39ae0e7f783d83b1349b2367350cb27
-
SHA1
2fe26faaadb7bbe6e7b9cac9ecee053cb82685ce
-
SHA256
8eb3617768ce4693b726bb8187e5cccea3359de0196d6f2bbe555c31f12d1234
-
SHA512
24fb8ec717e1c2a712db52a737eaa6f9f16c5aa6835ff51f72f33327d06945aa3b1d0f110dcd40d5c195b8647769a9d1d8832d057bca8cca3887e6e4674a1089
-
SSDEEP
196608:EcLaAXDHqv/L2VmnTNfwZHYYaSEcytbOOhU:9xDKXL2VmnBkPQbO
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
svhost.exepid process 2464 svhost.exe 2464 svhost.exe 2464 svhost.exe 2464 svhost.exe 2464 svhost.exe 2464 svhost.exe 2464 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
svhost.exedescription pid process target process PID 2516 wrote to memory of 2464 2516 svhost.exe svhost.exe PID 2516 wrote to memory of 2464 2516 svhost.exe svhost.exe PID 2516 wrote to memory of 2464 2516 svhost.exe svhost.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI25162\api-ms-win-core-file-l1-2-0.dllFilesize
21KB
MD54454791276f4716342de12eaa6ab5007
SHA1cfeab7a4aed07adf0e22bb40ca408046896173fa
SHA2560545cfcb511dcca7764a31465c211ff3d6b91ed5070c00a8613599edff4b7979
SHA512e86ae200f473ffc00b4e4f3fcdb094cdf896184dd048aed3c408f145282cf5da67889e11334460984c60f332d2faecf9a89a5f3774c81b488aeaadb5e1520497
-
C:\Users\Admin\AppData\Local\Temp\_MEI25162\api-ms-win-core-file-l2-1-0.dllFilesize
18KB
MD5bfffa7117fd9b1622c66d949bac3f1d7
SHA1402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA2561ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
-
C:\Users\Admin\AppData\Local\Temp\_MEI25162\api-ms-win-core-localization-l1-2-0.dllFilesize
21KB
MD5584935f54f7a9947a2fec9a6d827e558
SHA13ee71afa08464bab300983a2bc627cd791d574dc
SHA25678b921153dd5776295b464f6b887d6cf3e24097d53305a0c584256b8f569f9fb
SHA512933658ceeb0a79d968b1ad32fa392f0e9f630c0264919fc729986f0d97ce72c5e5c554a42c068eacbbea24e4adca686ce10701803c6e80c77f7ed6d121cff749
-
C:\Users\Admin\AppData\Local\Temp\_MEI25162\api-ms-win-core-processthreads-l1-1-1.dllFilesize
21KB
MD5fb60a721cfca0b3307067a7db90a996e
SHA1fd4d776f3b9f1f7b658a2abdb5d321721eb19488
SHA2562f031764abb092fa03732d27876a29f62d40ba0fdce08b66559915dc2879d10c
SHA512b510c8a1436463ee4206cc6d3585a883bb195cdb3ed134eda286939ba50027ae2c01e409654252966717ccb0fbd2d09aae9d9412fa94491bf403103e7b62a5bb
-
C:\Users\Admin\AppData\Local\Temp\_MEI25162\api-ms-win-core-timezone-l1-1-0.dllFilesize
21KB
MD59be41c3476bdf52936e25368c14b87c4
SHA122a068671f0e3fc9041a193158cfb95fa3618419
SHA2569c208b51ad3331ae87ce2642d9a8b119add74798524ea1c3cb1e995045f452b9
SHA5120756986284b8ea16cc1d35c8a87352e70b7b44a892b3b4a1266c64607aa0dd161e5da4b0286c6dbb38f040d538c85e6c4af26148a31d1382f86b12b4b389463d
-
C:\Users\Admin\AppData\Local\Temp\_MEI25162\python310.dllFilesize
4.2MB
MD5e9c0fbc99d19eeedad137557f4a0ab21
SHA18945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf
SHA2565783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5
SHA51274e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b
-
C:\Users\Admin\AppData\Local\Temp\_MEI25162\ucrtbase.dllFilesize
992KB
MD50e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA14189f4459c54e69c6d3155a82524bda7549a75a6
SHA2568a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd