Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:21
Static task
static1
Behavioral task
behavioral1
Sample
ba26ecae443c2668fe49db39333d0ffe58b1cd9fb6c34155a9b3f51bf93e4076.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ba26ecae443c2668fe49db39333d0ffe58b1cd9fb6c34155a9b3f51bf93e4076.exe
Resource
win10v2004-20240508-en
General
-
Target
ba26ecae443c2668fe49db39333d0ffe58b1cd9fb6c34155a9b3f51bf93e4076.exe
-
Size
79KB
-
MD5
22b9718a56cfbb26136e4fc849fabb3b
-
SHA1
7c3ea782989db51f70ce3e0d89ee1435cd2cf99a
-
SHA256
ba26ecae443c2668fe49db39333d0ffe58b1cd9fb6c34155a9b3f51bf93e4076
-
SHA512
4940bf55e3942fccdbfa599689784cf03a4edd77b3496b3cc72a81ed9c1c85827333261dd89e15870d300fdffde2cebb2d12c4ab5c1834bf4aa340e65fcb6a2f
-
SSDEEP
1536:zvI+hUIvhCXa+buOQA8AkqUhMb2nuy5wgIP0CSJ+5yXB8GMGlZ5G:zvIMUV77GdqU7uy5w9WMyXN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
pid process 2284 [email protected] -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 3036 cmd.exe 3036 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ba26ecae443c2668fe49db39333d0ffe58b1cd9fb6c34155a9b3f51bf93e4076.execmd.exedescription pid process target process PID 1832 wrote to memory of 3036 1832 ba26ecae443c2668fe49db39333d0ffe58b1cd9fb6c34155a9b3f51bf93e4076.exe cmd.exe PID 1832 wrote to memory of 3036 1832 ba26ecae443c2668fe49db39333d0ffe58b1cd9fb6c34155a9b3f51bf93e4076.exe cmd.exe PID 1832 wrote to memory of 3036 1832 ba26ecae443c2668fe49db39333d0ffe58b1cd9fb6c34155a9b3f51bf93e4076.exe cmd.exe PID 1832 wrote to memory of 3036 1832 ba26ecae443c2668fe49db39333d0ffe58b1cd9fb6c34155a9b3f51bf93e4076.exe cmd.exe PID 3036 wrote to memory of 2284 3036 cmd.exe [email protected] PID 3036 wrote to memory of 2284 3036 cmd.exe [email protected] PID 3036 wrote to memory of 2284 3036 cmd.exe [email protected] PID 3036 wrote to memory of 2284 3036 cmd.exe [email protected]
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba26ecae443c2668fe49db39333d0ffe58b1cd9fb6c34155a9b3f51bf93e4076.exe"C:\Users\Admin\AppData\Local\Temp\ba26ecae443c2668fe49db39333d0ffe58b1cd9fb6c34155a9b3f51bf93e4076.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2284
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]Filesize
79KB
MD5ecbb626df1d934855a3ddba7d0b0d905
SHA19c80c1150e8cc64e7efbdd472cf61b1c5f522469
SHA256a7b4c06d62d93f30e4ae46faa76454d0b82a41b095f6d7fdc9fe68cfe1a5a692
SHA51227e5a96b462c2c334719ae4e5aaf701c7598207dcf691af78adc421fc8649376befaadaa426466d3bf19bd245ec31a2420ad8340287e3555e001897d45b67460
-
memory/1832-8-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2284-7-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB