edc2569ca00fba2e64ff7727b64b3cdf7182f9a37226f190aeb57a755f225ede | Triage

Resubmissions

19-04-2024 22:03

240419-1yfp3she5x 10

19-04-2024 18:14

240419-wvbvhabf45 7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 18:14

Sharing

Report Analysis Logs

General

Target

hacn.exe
Size

12.3MB
MD5

0b6cd2cf55fadd40218d09b5617022f3
SHA1

f33ce545bf7d07c84755cea6151b44ca17889a70
SHA256

edc2569ca00fba2e64ff7727b64b3cdf7182f9a37226f190aeb57a755f225ede
SHA512

d45ee80d7d17c62257a117de22b647317a728ac716d3193af539944e985055735ce5a6444f08f49a15a0dd397d1557e830129b810b703dc508d3a7ed9a7e6d96
SSDEEP

196608:ehHHDfyGowBdnpkYRMZuYcISpZUUvExfiYvq7IsBfW023p0R6iM9j:2DfDoc64YcIyZU0E9dufW0ayRI9

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

hacn.exe

pid process

1648 hacn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

hacn.exe

description	pid	process	target process
PID 2056 wrote to memory of 1648	2056	hacn.exe	hacn.exe
PID 2056 wrote to memory of 1648	2056	hacn.exe	hacn.exe
PID 2056 wrote to memory of 1648	2056	hacn.exe	hacn.exe

C:\Users\Admin\AppData\Local\Temp\hacn.exe
"C:\Users\Admin\AppData\Local\Temp\hacn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\hacn.exe
  "C:\Users\Admin\AppData\Local\Temp\hacn.exe"
  2⤵
  - Loads dropped DLL
  PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI20562\python310.dll

Filesize
4.3MB

MD5
63a1fa9259a35eaeac04174cecb90048

SHA1
0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

SHA256
14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

SHA512
896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

Download Submit