36a33e7da8ad27ce449d6bc53c6ca650bc283b8f96d5fe797187aea40e0dcc68

Submit
Reports

Overview

overview

Static

static

100e14f03b...37.exe

windows10-2004-x64

14e92d7584...fd.exe

windows7-x64

14e92d7584...fd.exe

windows10-2004-x64

228c350439...1a.exe

windows7-x64

228c350439...1a.exe

windows10-2004-x64

236732ce45...d5.exe

windows7-x64

236732ce45...d5.exe

windows10-2004-x64

2a0ae333a9...1a.exe

windows7-x64

2a0ae333a9...1a.exe

windows10-2004-x64

2b467ee19e...44.exe

windows7-x64

2b467ee19e...44.exe

windows10-2004-x64

399f6dfec3...0c.exe

windows10-2004-x64

3ddd80ba69...8c.exe

windows7-x64

3ddd80ba69...8c.exe

windows10-2004-x64

4be1f370e8...6b.exe

windows7-x64

4be1f370e8...6b.exe

windows10-2004-x64

65a31de21f...f0.exe

windows10-2004-x64

790345d8c0...0a.exe

windows7-x64

790345d8c0...0a.exe

windows10-2004-x64

7a5164cea0...f7.exe

windows7-x64

7a5164cea0...f7.exe

windows10-2004-x64

9a7761a218...43.exe

windows7-x64

9a7761a218...43.exe

windows10-2004-x64

a26df59e48...78.exe

windows10-2004-x64

c0c8fc8c3b...49.exe

windows7-x64

c0c8fc8c3b...49.exe

windows10-2004-x64

c4172a7d8d...fa.exe

windows7-x64

c4172a7d8d...fa.exe

windows10-2004-x64

d3855d0640...68.exe

windows7-x64

d3855d0640...68.exe

windows10-2004-x64

d6c7041aa6...93.exe

windows7-x64

d6c7041aa6...93.exe

windows10-2004-x64

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 05:30

Sharing

Copy URL

Twitter E-mail

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

100e14f03bac13fc1c4e178555a3dd9d1c0a021aa089b6b88cb8065f8163e837.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

14e92d75842bf0e1bcae35adc805c07925a4a6d97655b90182b6147b5efbaffd.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

14e92d75842bf0e1bcae35adc805c07925a4a6d97655b90182b6147b5efbaffd.exe

Resource

win10v2004-20240508-en

lumma stealer

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

228c35043919b5a4d810fd11dbb1b9646333aa6e75788617e4cc4ac41ab07a1a.exe

Resource

win7-20240419-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

228c35043919b5a4d810fd11dbb1b9646333aa6e75788617e4cc4ac41ab07a1a.exe

Resource

win10v2004-20240508-en

lumma stealer

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe

Resource

win10v2004-20240426-en

lumma stealer

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

2a0ae333a9b72768e8a05e7ebbfe4b15cf581f8c08129c0639aeed58eaf7901a.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

2a0ae333a9b72768e8a05e7ebbfe4b15cf581f8c08129c0639aeed58eaf7901a.exe

Resource

win10v2004-20240426-en

redline 5345987420 discovery infostealer spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral10

Sample

2b467ee19e1542f60392c1b29a264ffabce3e9a8da48a4707e8d8f1bea1d1244.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

2b467ee19e1542f60392c1b29a264ffabce3e9a8da48a4707e8d8f1bea1d1244.exe

Resource

win10v2004-20240426-en

redline 5195552529 discovery infostealer spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral12

Sample

399f6dfec39b77c21a8b31e45c5c8fb863a8b28a73a4923ff7543886ebfa0c0c.exe

Resource

win10v2004-20240508-en

redline ditro infostealer persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral13

Sample

3ddd80ba692516ca1977cdf6eb25ad59de7b9e87f447a412e2468a77ad1bbd8c.exe

Resource

win7-20240215-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

3ddd80ba692516ca1977cdf6eb25ad59de7b9e87f447a412e2468a77ad1bbd8c.exe

Resource

win10v2004-20240508-en

redline 5637482599 discovery infostealer spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral15

Sample

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

Resource

win10v2004-20240426-en

redline 5195552529 discovery infostealer spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral17

Sample

65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe

Resource

win10v2004-20240508-en

redline dimas evasion infostealer persistence trojan

windows10-2004-x64

9 signatures

150 seconds

Behavioral task

behavioral18

Sample

790345d8c07ae982c606f2db111e6ff6a2bae42847c106a6f096f208f1653d0a.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral19

Sample

790345d8c07ae982c606f2db111e6ff6a2bae42847c106a6f096f208f1653d0a.exe

Resource

win10v2004-20240508-en

redline zgrat discovery infostealer rat spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral20

Sample

7a5164cea09551d97475639ab8fb782d5fff907df5db0ff94ae2cb2a3b40dcf7.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral21

Sample

7a5164cea09551d97475639ab8fb782d5fff907df5db0ff94ae2cb2a3b40dcf7.exe

Resource

win10v2004-20240508-en

redline @deeqsio infostealer

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral22

Sample

9a7761a218bd7bd89d897848e3eafea1a05f151c3ab44668124ffa35c4d3a743.exe

Resource

win7-20240220-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral23

Sample

9a7761a218bd7bd89d897848e3eafea1a05f151c3ab44668124ffa35c4d3a743.exe

Resource

win10v2004-20240508-en

lumma stealer

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

a26df59e48ff80e63c4ae80b1ca4da56cf0629cdcaaa173b3f510b0b20722f78.exe

Resource

win10v2004-20240426-en

redline dimas evasion infostealer persistence trojan

windows10-2004-x64

9 signatures

150 seconds

Behavioral task

behavioral25

Sample

c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe

Resource

win10v2004-20240508-en

redline 7001210066 discovery infostealer spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral27

Sample

c4172a7d8d27c8367cd7a3b7b3d410e4678ddfd8748e6bf631c21e8f639c7efa.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

c4172a7d8d27c8367cd7a3b7b3d410e4678ddfd8748e6bf631c21e8f639c7efa.exe

Resource

win10v2004-20240426-en

redline 7001210066 discovery infostealer

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral29

Sample

d3855d0640853387bc0df63e4ddcbc8af40e8cbb259b6be8049d23526e31dd68.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral30

Sample

d3855d0640853387bc0df63e4ddcbc8af40e8cbb259b6be8049d23526e31dd68.exe

Resource

win10v2004-20240508-en

lumma stealer

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral31

Sample

d6c7041aa6a01fcdc7f6a9f60c8eaf8edcbcc73cb1802bc3623346b3b3219693.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral32

Sample

d6c7041aa6a01fcdc7f6a9f60c8eaf8edcbcc73cb1802bc3623346b3b3219693.exe

Resource

win10v2004-20240508-en

redline 7001210066 discovery infostealer

windows10-2004-x64

8 signatures

150 seconds

Report Analysis Logs

General

Target

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe
Size

306KB
MD5

d41a5cd7a3a7870992cfd75c5eff1637
SHA1

8365910e5f8fff802cd8d928351270432128abaa
SHA256

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b
SHA512

893c73fe37c917bf3c8557c1344e03daef3d1264a0296847fbd5e667e0070b6c920a58f709ec96bb2c1afd22a485d366479f57911eb5073e4c77e6f43243604e
SSDEEP

6144:vBZd9vSWh60RVAtljy11yiI8iz2jaYO9eGoW/JyL985:JZiWhHE4i6qfRyL985

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1260	1244	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1260	1244	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	28
PID 1244 wrote to memory of 1260	1244	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	28
PID 1244 wrote to memory of 1260	1244	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	28
PID 1244 wrote to memory of 1260	1244	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	28

Processes

C:\Users\Admin\AppData\Local\Temp\4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe
"C:\Users\Admin\AppData\Local\Temp\4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 88
  2⤵
  - Program crash
  PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-0-0x00000000013D8000-0x00000000013D9000-memory.dmp

Filesize
4KB

Download