Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:29
Static task
static1
Behavioral task
behavioral1
Sample
38217577af211415146b3e9b2ccf0de38041ffa7d4add72ca1f7397d56115021.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
38217577af211415146b3e9b2ccf0de38041ffa7d4add72ca1f7397d56115021.exe
Resource
win10v2004-20240508-en
General
-
Target
38217577af211415146b3e9b2ccf0de38041ffa7d4add72ca1f7397d56115021.exe
-
Size
79KB
-
MD5
192afd8da44bfec1c094acefd3a6eae6
-
SHA1
9dfd6c732840054457055fe262a62ddc0096b170
-
SHA256
38217577af211415146b3e9b2ccf0de38041ffa7d4add72ca1f7397d56115021
-
SHA512
e1a7e177c7923ca2f5f4870f0e3338c9d455d103998801b1cd41a6d1aa2ad4721f14290fb51bf18c86db2ba45f2cd24887536bf31de063b28d17f7ed060e6a64
-
SSDEEP
1536:zvvSjrPgawlHWzMLP0OOQA8AkqUhMb2nuy5wgIP0CSJ+5yMB8GMGlZ5G:zvvSj8aKHWgLP0bGdqU7uy5w9WMyMN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
pid process 2332 [email protected] -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1724 cmd.exe 1724 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
38217577af211415146b3e9b2ccf0de38041ffa7d4add72ca1f7397d56115021.execmd.exedescription pid process target process PID 2852 wrote to memory of 1724 2852 38217577af211415146b3e9b2ccf0de38041ffa7d4add72ca1f7397d56115021.exe cmd.exe PID 2852 wrote to memory of 1724 2852 38217577af211415146b3e9b2ccf0de38041ffa7d4add72ca1f7397d56115021.exe cmd.exe PID 2852 wrote to memory of 1724 2852 38217577af211415146b3e9b2ccf0de38041ffa7d4add72ca1f7397d56115021.exe cmd.exe PID 2852 wrote to memory of 1724 2852 38217577af211415146b3e9b2ccf0de38041ffa7d4add72ca1f7397d56115021.exe cmd.exe PID 1724 wrote to memory of 2332 1724 cmd.exe [email protected] PID 1724 wrote to memory of 2332 1724 cmd.exe [email protected] PID 1724 wrote to memory of 2332 1724 cmd.exe [email protected] PID 1724 wrote to memory of 2332 1724 cmd.exe [email protected]
Processes
-
C:\Users\Admin\AppData\Local\Temp\38217577af211415146b3e9b2ccf0de38041ffa7d4add72ca1f7397d56115021.exe"C:\Users\Admin\AppData\Local\Temp\38217577af211415146b3e9b2ccf0de38041ffa7d4add72ca1f7397d56115021.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\[email protected]Filesize
79KB
MD552e228a66ee8d4a6ac99f1d622c97ce6
SHA1d5d0504ab7ed56f2283edbe110bd585f625422c5
SHA25632a072cafc91761d39f1e0636dca542e49bfd653230cf6ddf5f5608605f8aef8
SHA51248468f113636f31e6dd02c68a69a0a10b9e401d9135db2def8901934fcd29df94e0acebaded8e65f035ae0004df480bb0442d2f585e4a54adb955e40115be520
-
memory/2332-7-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2852-8-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB