Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
08/04/2024, 21:31
Behavioral task
behavioral1
Sample
Thanos.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Thanos.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Thanos.exe
Resource
win11-20240221-en
General
-
Target
Thanos.exe
-
Size
6.9MB
-
MD5
505de66c51ee81ba2a62d990c6646965
-
SHA1
13a6230a5ea499501649e85d4d534fe958993353
-
SHA256
e909c555fe1eb48ad8f946b0cc27f05574e0b4baec0d623788a769e422a331bf
-
SHA512
d3c45dc1376c550caa5924bc38cc6fd55bb225018e6deaa948cf55676c40b45f78c82fba3944b2c83031eafaee9745c4dcecc89b30a4b6a824d8801d87044e21
-
SSDEEP
196608:8nh/7wd1W903eV4Q+tpDjIIAcwD0RPXvEkfsiALt:mwzW+eGQ69jo0jsJ5
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
pid Process 4772 Thanos.exe 4772 Thanos.exe 4772 Thanos.exe 4772 Thanos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 4364 wrote to memory of 4772 4364 Thanos.exe 81 PID 4364 wrote to memory of 4772 4364 Thanos.exe 81 PID 4772 wrote to memory of 3396 4772 Thanos.exe 82 PID 4772 wrote to memory of 3396 4772 Thanos.exe 82 PID 4772 wrote to memory of 5096 4772 Thanos.exe 84 PID 4772 wrote to memory of 5096 4772 Thanos.exe 84 PID 4772 wrote to memory of 3652 4772 Thanos.exe 86 PID 4772 wrote to memory of 3652 4772 Thanos.exe 86 PID 4772 wrote to memory of 1172 4772 Thanos.exe 88 PID 4772 wrote to memory of 1172 4772 Thanos.exe 88 PID 4772 wrote to memory of 2408 4772 Thanos.exe 90 PID 4772 wrote to memory of 2408 4772 Thanos.exe 90 PID 4772 wrote to memory of 448 4772 Thanos.exe 92 PID 4772 wrote to memory of 448 4772 Thanos.exe 92 PID 4772 wrote to memory of 4588 4772 Thanos.exe 94 PID 4772 wrote to memory of 4588 4772 Thanos.exe 94 PID 4772 wrote to memory of 5052 4772 Thanos.exe 96 PID 4772 wrote to memory of 5052 4772 Thanos.exe 96 PID 4772 wrote to memory of 3564 4772 Thanos.exe 98 PID 4772 wrote to memory of 3564 4772 Thanos.exe 98 PID 4772 wrote to memory of 2416 4772 Thanos.exe 100 PID 4772 wrote to memory of 2416 4772 Thanos.exe 100 PID 4772 wrote to memory of 1392 4772 Thanos.exe 102 PID 4772 wrote to memory of 1392 4772 Thanos.exe 102 PID 3396 wrote to memory of 1676 3396 cmd.exe 104 PID 3396 wrote to memory of 1676 3396 cmd.exe 104 PID 4772 wrote to memory of 2848 4772 Thanos.exe 105 PID 4772 wrote to memory of 2848 4772 Thanos.exe 105 PID 5096 wrote to memory of 3500 5096 cmd.exe 106 PID 5096 wrote to memory of 3500 5096 cmd.exe 106 PID 4772 wrote to memory of 4036 4772 Thanos.exe 108 PID 4772 wrote to memory of 4036 4772 Thanos.exe 108 PID 448 wrote to memory of 3956 448 cmd.exe 110 PID 448 wrote to memory of 3956 448 cmd.exe 110 PID 3652 wrote to memory of 3852 3652 cmd.exe 111 PID 3652 wrote to memory of 3852 3652 cmd.exe 111 PID 2408 wrote to memory of 3780 2408 cmd.exe 112 PID 2408 wrote to memory of 3780 2408 cmd.exe 112 PID 1172 wrote to memory of 4988 1172 cmd.exe 113 PID 1172 wrote to memory of 4988 1172 cmd.exe 113 PID 4588 wrote to memory of 3292 4588 cmd.exe 114 PID 4588 wrote to memory of 3292 4588 cmd.exe 114 PID 1392 wrote to memory of 2928 1392 cmd.exe 115 PID 1392 wrote to memory of 2928 1392 cmd.exe 115 PID 5052 wrote to memory of 3552 5052 cmd.exe 117 PID 5052 wrote to memory of 3552 5052 cmd.exe 117 PID 2416 wrote to memory of 1956 2416 cmd.exe 116 PID 2416 wrote to memory of 1956 2416 cmd.exe 116 PID 4036 wrote to memory of 1460 4036 cmd.exe 118 PID 4036 wrote to memory of 1460 4036 cmd.exe 118 PID 3564 wrote to memory of 3484 3564 cmd.exe 119 PID 3564 wrote to memory of 3484 3564 cmd.exe 119 PID 2848 wrote to memory of 1752 2848 cmd.exe 120 PID 2848 wrote to memory of 1752 2848 cmd.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\Thanos.exe"C:\Users\Admin\AppData\Local\Temp\Thanos.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\Thanos.exe"C:\Users\Admin\AppData\Local\Temp\Thanos.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Thanos-Crasher\Crasher.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\system32\mode.commode 160,504⤵PID:1676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Thanos-Crasher\Crasher.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\system32\mode.commode 160,504⤵PID:3500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Thanos-Crasher\Crasher.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\system32\mode.commode 160,504⤵PID:3852
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Thanos-Crasher\Crasher.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\system32\mode.commode 160,504⤵PID:4988
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Thanos-Crasher\Crasher.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\system32\mode.commode 160,504⤵PID:3780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Thanos-Crasher\Crasher.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\system32\mode.commode 160,504⤵PID:3956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Thanos-Crasher\Crasher.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\system32\mode.commode 160,504⤵PID:3292
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Thanos-Crasher\Crasher.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\system32\mode.commode 160,504⤵PID:3552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Thanos-Crasher\Crasher.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\system32\mode.commode 160,504⤵PID:3484
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Thanos-Crasher\Crasher.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\system32\mode.commode 160,504⤵PID:1956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Thanos-Crasher\Crasher.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\system32\mode.commode 160,504⤵PID:2928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Thanos-Crasher\Crasher.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\system32\mode.commode 160,504⤵PID:1752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Thanos-Crasher\Crasher.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\system32\mode.commode 160,504⤵PID:1460
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5ff257f113154e5a3b9fb52e5a52dd8c9
SHA1a5c44efee254b8a468050adcfbf68b2ba9c6a946
SHA25669543a5a5df318d3c4602faffccde3dc7162ecee0f1f57e3eae1b780b96af93e
SHA51228a0f702f45eec2239d4e10177141fdb8f8f8fb00b4d44c803fd1de7348c522e44649e7abefcaa66b9d3f770e19d2843b3c0b9622d14946dc694c09aaf5bdd81
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
82KB
MD5c7ce973f261f698e3db148ccad057c96
SHA159809fd48e8597a73211c5df64c7292c5d120a10
SHA25602d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
SHA512a924750b1825747a622eef93331fd764d824c954297e37e8dc93a450c11aa7ab3ad7c3b823b11656b86e64de3cd5d409fda15db472488dfaa4bb50341f0b29d1
-
Filesize
247KB
MD521c73e7e0d7dad7a1fe728e3b80ce073
SHA17b363af01e83c05d0ea75299b39c31d948bbfe01
SHA256a28c543976aa4b6d37da6f94a280d72124b429f458d0d57b7dbcf71b4bea8f73
SHA5120357102bffc2ec2bc6ff4d9956d6b8e77ed8558402609e558f1c1ebc1baca6aeaa5220a7781a69b783a54f3e76362d1f74d817e4ee22aac16c7f8c86b6122390
-
Filesize
63KB
MD5f495d1897a1b52a2b15c20dcecb84b47
SHA18cb65590a8815bda58c86613b6386b5982d9ec3f
SHA256e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae
SHA512725d408892887bebd5bcf040a0ecc6a4e4b608815b9dea5b6f7b95c812715f82079896df33b0830c9f787ffe149b8182e529bb1f78aadd89df264cf8853ee4c4
-
Filesize
155KB
MD54e2239ece266230ecb231b306adde070
SHA1e807a078b71c660db10a27315e761872ffd01443
SHA25634130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
SHA51286e6a1eab3529e600dd5caab6103e34b0f618d67322a5ecf1b80839faa028150c492a5cf865a2292cc8584fba008955da81a50b92301583424401d249c5f1401
-
Filesize
81KB
MD5899380b2d48df53414b974e11bb711e3
SHA1f1d11f7e970a7cd476e739243f8f197fcb3ad590
SHA256b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
SHA5127426ca5e7a404b9628e2966dae544f3e8310c697145567b361825dc0b5c6cd87f2caf567def8cd19e73d68643f2f38c08ff4ff0bb0a459c853f241b8fdf40024
-
Filesize
1.3MB
MD54cd74e70336c96f7172a114dfa74eb25
SHA14d96748b2221857d3698499597884ae0ea639ee3
SHA2561e5198462510015a5b855ea01e287fa9d765be4357cba60cfedafb9b1b33bdf4
SHA5129cd4e846aadfe79d086ce285e9dd58f241f67791a9b87c327852676f3c3f543832032de1dd6bac33f268bd782c2fd30fce49e4262da8ff052bc3f4684057dba9
-
Filesize
4.9MB
MD551e8a5281c2092e45d8c97fbdbf39560
SHA1c499c810ed83aaadce3b267807e593ec6b121211
SHA2562a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
SHA51298b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
-
Filesize
6.6MB
MD55c5602cda7ab8418420f223366fff5db
SHA152f81ee0aef9b6906f7751fd2bbd4953e3f3b798
SHA256e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
SHA51251c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
-
Filesize
30KB
MD5bffff83a000baf559f3eb2b599a1b7e8
SHA17f9238bda6d0c7cc5399c6b6ab3b42d21053f467
SHA256bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab
SHA5123c0ba0cf356a727066ae0d0d6523440a882aafb3ebdf70117993effd61395deebf179948f8c7f5222d59d1ed748c71d9d53782e16bd2f2eccc296f2f8b4fc948
-
Filesize
1.1MB
MD5a1388676824ce6347d31d6c6a7a1d1b5
SHA127dd45a5c9b7e61bb894f13193212c6d5668085b
SHA2562480a78815f619a631210e577e733c9bafecb7f608042e979423c5850ee390ff
SHA51226ea1b33f14f08bb91027e0d35ac03f6203b4dfeee602bb592c5292ab089b27ff6922da2804a9e8a28e47d4351b32cf93445d894f00b4ad6e2d0c35c6c7f1d89