39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe
Size

55KB
MD5

848180c9ca9a49609d059cabd0fbade7
SHA1

c0be6a725d14cccddad98a8e46136b0bf279d131
SHA256

39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6
SHA512

ea945009e685c354f4156dd8ae5ce01e4f462a97eb2eb08d7b53a46d5adc0e4f47ac2242d3ac8d2fab40b708f29d84efa220d57a0da212d20c43a730c9e31dee
SSDEEP

768:QFM2Og2PeORuCGd4pSY7C3fg4YWPhbgd9PyOV6TEDQJXnupVWmuGMWx:oT25RC4pW3fj87PhV6zhaVR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1992	1312	39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe	29
PID 1312 wrote to memory of 1992	1312	39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe	29
PID 1312 wrote to memory of 1992	1312	39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe	29
PID 1312 wrote to memory of 1992	1312	39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe	29
PID 1992 wrote to memory of 1744	1992	cmd.exe	30
PID 1992 wrote to memory of 1744	1992	cmd.exe	30
PID 1992 wrote to memory of 1744	1992	cmd.exe	30
PID 1992 wrote to memory of 1744	1992	cmd.exe	30
PID 1992 wrote to memory of 1744	1992	cmd.exe	30
PID 1992 wrote to memory of 1744	1992	cmd.exe	30
PID 1992 wrote to memory of 1744	1992	cmd.exe	30
PID 1312 wrote to memory of 2052	1312	39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe	31
PID 1312 wrote to memory of 2052	1312	39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe	31
PID 1312 wrote to memory of 2052	1312	39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe	31
PID 1312 wrote to memory of 2052	1312	39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe	31
PID 2052 wrote to memory of 2736	2052	cmd.exe	32
PID 2052 wrote to memory of 2736	2052	cmd.exe	32
PID 2052 wrote to memory of 2736	2052	cmd.exe	32
PID 2052 wrote to memory of 2736	2052	cmd.exe	32
PID 1312 wrote to memory of 2944	1312	39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe	33
PID 1312 wrote to memory of 2944	1312	39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe	33
PID 1312 wrote to memory of 2944	1312	39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe	33
PID 1312 wrote to memory of 2944	1312	39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe	33
PID 2944 wrote to memory of 1548	2944	cmd.exe	34
PID 2944 wrote to memory of 1548	2944	cmd.exe	34
PID 2944 wrote to memory of 1548	2944	cmd.exe	34
PID 2944 wrote to memory of 1548	2944	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe
"C:\Users\Admin\AppData\Local\Temp\39ee0b399bd58b5bb3e3bf84442336e62c11979c140a650a648f4da3f984e7b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c regsvr32 /S "C:\Program Files\NetIPCamera\npIPCamera.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /S "C:\Program Files\NetIPCamera\npIPCamera.dll"
    3⤵
    PID:1744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tvt.cn/npIPCamera" /v "Path" /t reg_sz /d "C:\Program Files\NetIPCamera\npIPCamera.dll" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tvt.cn/npIPCamera" /v "Path" /t reg_sz /d "C:\Program Files\NetIPCamera\npIPCamera.dll" /f
    3⤵
    PID:2736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\npIPCamera" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\npIPCamera" /f
    3⤵
    PID:1548

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads