Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:55
Static task
static1
Behavioral task
behavioral1
Sample
86535e3dfa341160c0a245a96baa221e5802607e94e8897e8bf5b9b948ab6f23.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
86535e3dfa341160c0a245a96baa221e5802607e94e8897e8bf5b9b948ab6f23.exe
Resource
win10v2004-20240508-en
General
-
Target
86535e3dfa341160c0a245a96baa221e5802607e94e8897e8bf5b9b948ab6f23.exe
-
Size
79KB
-
MD5
108bb6be90af45aeb11407c5d3aedfa7
-
SHA1
fe351f14955836bf8e3ab65d8ec7d63482b20431
-
SHA256
86535e3dfa341160c0a245a96baa221e5802607e94e8897e8bf5b9b948ab6f23
-
SHA512
41eed0baf67e4fd3adb89b6bc190b5127a7f4c46f5e50b1d141b8842411f52ed10ba0481f86d1391669ec9ad77d447618ce740bab83191d670adf51458cd9ca3
-
SSDEEP
1536:zvlmFTpp6tczOQA8AkqUhMb2nuy5wgIP0CSJ+5yZB8GMGlZ5G:zvlmVv6DGdqU7uy5w9WMyZN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
pid process 2132 [email protected] -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1732 cmd.exe 1732 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
86535e3dfa341160c0a245a96baa221e5802607e94e8897e8bf5b9b948ab6f23.execmd.exedescription pid process target process PID 2620 wrote to memory of 1732 2620 86535e3dfa341160c0a245a96baa221e5802607e94e8897e8bf5b9b948ab6f23.exe cmd.exe PID 2620 wrote to memory of 1732 2620 86535e3dfa341160c0a245a96baa221e5802607e94e8897e8bf5b9b948ab6f23.exe cmd.exe PID 2620 wrote to memory of 1732 2620 86535e3dfa341160c0a245a96baa221e5802607e94e8897e8bf5b9b948ab6f23.exe cmd.exe PID 2620 wrote to memory of 1732 2620 86535e3dfa341160c0a245a96baa221e5802607e94e8897e8bf5b9b948ab6f23.exe cmd.exe PID 1732 wrote to memory of 2132 1732 cmd.exe [email protected] PID 1732 wrote to memory of 2132 1732 cmd.exe [email protected] PID 1732 wrote to memory of 2132 1732 cmd.exe [email protected] PID 1732 wrote to memory of 2132 1732 cmd.exe [email protected]
Processes
-
C:\Users\Admin\AppData\Local\Temp\86535e3dfa341160c0a245a96baa221e5802607e94e8897e8bf5b9b948ab6f23.exe"C:\Users\Admin\AppData\Local\Temp\86535e3dfa341160c0a245a96baa221e5802607e94e8897e8bf5b9b948ab6f23.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]Filesize
79KB
MD58751560a51ae33e569f85baa78bc8561
SHA1a8d065165118dd5969b03d427284620d163fd1e3
SHA2564c06557933190885d30d2f3687b5a8b42efe3ed1d52d0f9f472a0cf1fe1995eb
SHA51279e7588e5fe84c4a32758a0d78b0ed256e5ca654101b4efc56eca38de30b6476dd2553e6c67ee7b1bedbcfe8d848c57a4eabecb4cc2d8941c6c441441303be89
-
memory/2132-7-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2620-8-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB