75cdc03e89729226eaefb9259aab9beb4052ddef0280bbf53dcaf8ef9f58d917

Analysis

max time kernel
146s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Document 151-512024.exe
Size 1.2MB
Sample240508-jfvmvacb55
SHA256 75cdc03e89729226eaefb9259aab9beb4052ddef0280bbf53dcaf8ef9f58d917
MD5 8e009a43143d3afdde5e91b311e4018b
SHA1 332f1f946b6aaadecb3de55c5880d0c61021073f
SHA512 2db471514d4720afed163a576b7c25ce6e45bf46c129ce03ebaa1422e588dcbe16a6107fd34fb7606f6b57e0a5623bbe0ce314584ddd060639a1f6e9345daf24
SSDEEP 24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8a+z74Zcy9xCN6:YTvC/MTQYxsWR7a+vyn
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1284 set thread context of 2032	1284	Document 151-512024.exe	28
PID 2032 set thread context of 1200	2032	svchost.exe	21
PID 2032 set thread context of 2424	2032	svchost.exe	31
PID 2424 set thread context of 1200	2424	netbtugc.exe	21

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2032	svchost.exe
2032	svchost.exe
2032	svchost.exe
2032	svchost.exe
2032	svchost.exe
2032	svchost.exe
2032	svchost.exe
2032	svchost.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe
2424	netbtugc.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1284	Document 151-512024.exe
2032	svchost.exe
1200	Explorer.EXE
1200	Explorer.EXE
2424	netbtugc.exe
2424	netbtugc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 2032	1284	Document 151-512024.exe	28
PID 1284 wrote to memory of 2032	1284	Document 151-512024.exe	28
PID 1284 wrote to memory of 2032	1284	Document 151-512024.exe	28
PID 1284 wrote to memory of 2032	1284	Document 151-512024.exe	28
PID 1284 wrote to memory of 2032	1284	Document 151-512024.exe	28
PID 1200 wrote to memory of 2424	1200	Explorer.EXE	31
PID 1200 wrote to memory of 2424	1200	Explorer.EXE	31
PID 1200 wrote to memory of 2424	1200	Explorer.EXE	31
PID 1200 wrote to memory of 2424	1200	Explorer.EXE	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\Document 151-512024.exe
  "C:\Users\Admin\AppData\Local\Temp\Document 151-512024.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Document 151-512024.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2032
- C:\Windows\SysWOW64\netbtugc.exe
  "C:\Windows\SysWOW64\netbtugc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

gobioid

Path C:\Users\Admin\AppData\Local\Temp\gobioid
Size 264KB
SHA256 297d72a6ca8e98558823b71f551ec72508b1adcec64596d41387978fd0ffbd54
MD5 3b92c7c7e1d069d027090bbb8c4c6b3c
SHA1 473ee15a3c0adf847ed03b6861ee051c78e6384c
SHA512 d5c52ddd13ab9b2a47159c46fa8e50e54794977d5740abfa2b6ba0456ad0381750110749804ffc771213189be1cdca1ec89c174e87c72c71af3d1ca4f7300e4e
SSDEEP 3072:P8mwFzK0eX0mcT2dftSU1THjhRqU3S2FabA1im6R2ldqgTtSxEMozosAGyDt/Fk9:UmQK0/mcTkt9LmUTsc1X5SyMTslylFTq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1200-18-0x0000000002C70000-0x0000000002D70000-memory.dmp

Download

memory/1200-27-0x0000000008E00000-0x0000000009470000-memory.dmp

Download

memory/1200-19-0x0000000008E00000-0x0000000009470000-memory.dmp

Download

memory/1284-11-0x00000000000A0000-0x00000000000A4000-memory.dmp

Download

memory/2032-13-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Download

memory/2032-17-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/2032-16-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2032-15-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2032-14-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2032-23-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/2032-12-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2032-22-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2424-20-0x00000000000F0000-0x000000000012F000-memory.dmp

Download

memory/2424-24-0x00000000009B0000-0x0000000000CB3000-memory.dmp

Download

memory/2424-25-0x00000000000F0000-0x000000000012F000-memory.dmp

Download

memory/2424-26-0x00000000004D0000-0x0000000000570000-memory.dmp

Download

memory/2424-21-0x00000000000F0000-0x000000000012F000-memory.dmp

Download

memory/2424-28-0x00000000000F0000-0x000000000012F000-memory.dmp

Download

memory/2424-29-0x00000000004D0000-0x0000000000570000-memory.dmp

Download