b195c8a81abf7913891a8bae26d1a5ad70dc5fdc555a9b57b848a82e251160eb

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

이미지 및 영상 저작권 위반 목��.exe
Size

2.1MB
MD5

292a5af0d8d4a5803022019507a83bed
SHA1

85310ecfd16b0920977229ad87f08d1207e756e6
SHA256

b195c8a81abf7913891a8bae26d1a5ad70dc5fdc555a9b57b848a82e251160eb
SHA512

c5cdec88a0ef29f7f7fa92f73296bb6d6b7bde8ccfc600e3fb3012288997981cc1cc356675e32bab55b684ab5b8838ee6f2032cdcac888d2cea5ee681a743766
SSDEEP

24576:ZUubL6cMcjdtsnFVZ+Ghc8zTxm+6Sv/Sr4XDeErmauz5y868Vk5rzarBNz0Kpcq:ZUuGOqFVZfhc8zM+6SvTSz5y868Vk5uV

Score

5^/10

Malware Config

Signatures

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

이미지 및 영상 저작권 위반 목��.exe

pid process

1464 이미지 및 영상 저작권 위반 목��.exe

pid	process
1464	이미지 및 영상 저작권 위반 목��.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

이미지 및 영상 저작권 위반 목��.exe

description	pid	process	target process
PID 1464 wrote to memory of 636	1464	이미지 및 영상 저작권 위반 목��.exe	이미지 및 영상 저작권 위반 목��.exe
PID 1464 wrote to memory of 636	1464	이미지 및 영상 저작권 위반 목��.exe	이미지 및 영상 저작권 위반 목��.exe
PID 1464 wrote to memory of 636	1464	이미지 및 영상 저작권 위반 목��.exe	이미지 및 영상 저작권 위반 목��.exe
PID 1464 wrote to memory of 636	1464	이미지 및 영상 저작권 위반 목��.exe	이미지 및 영상 저작권 위반 목��.exe
PID 1464 wrote to memory of 636	1464	이미지 및 영상 저작권 위반 목��.exe	이미지 및 영상 저작권 위반 목��.exe
PID 1464 wrote to memory of 636	1464	이미지 및 영상 저작권 위반 목��.exe	이미지 및 영상 저작권 위반 목��.exe
PID 1464 wrote to memory of 636	1464	이미지 및 영상 저작권 위반 목��.exe	이미지 및 영상 저작권 위반 목��.exe

C:\Users\Admin\AppData\Local\Temp\이미지 및 영상 저작권 위반 목��.exe
"C:\Users\Admin\AppData\Local\Temp\이미지 및 영상 저작권 위반 목��.exe"
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\이미지 및 영상 저작권 위반 목��.exe
  "C:\Users\Admin\AppData\Local\Temp\이미지 및 영상 저작권 위반 목��.exe"
  2⤵
  PID:636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/636-19-0x00000000001C0000-0x000000000020F000-memory.dmp

Filesize
316KB

Download
memory/636-17-0x00000000001C0000-0x000000000020F000-memory.dmp

Filesize
316KB

Download
memory/636-16-0x00000000001C0000-0x000000000020F000-memory.dmp

Filesize
316KB

Download
memory/636-14-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/636-13-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/636-7-0x00000000001C0000-0x000000000020F000-memory.dmp

Filesize
316KB

Download
memory/1464-4-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download
memory/1464-10-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download
memory/1464-8-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download
memory/1464-5-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/1464-6-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/1464-0-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download
memory/1464-3-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download
memory/1464-1-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download