Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:25
Static task
static1
Behavioral task
behavioral1
Sample
bc14581d4ca447782ee7abc0d8465f5d90f4deadc7f2df981ab5aa3ad353ffb7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bc14581d4ca447782ee7abc0d8465f5d90f4deadc7f2df981ab5aa3ad353ffb7.exe
Resource
win10v2004-20240426-en
General
-
Target
bc14581d4ca447782ee7abc0d8465f5d90f4deadc7f2df981ab5aa3ad353ffb7.exe
-
Size
79KB
-
MD5
117d1ef5c7c6df89fd2373bde4579062
-
SHA1
f053cde6dbdc7b113e18516860df0b87e98cfbdd
-
SHA256
bc14581d4ca447782ee7abc0d8465f5d90f4deadc7f2df981ab5aa3ad353ffb7
-
SHA512
e58e1c555666d5faad56ee2cd00f73f5cedd226a988ae07d943596691b7b9e535a3090f1d942d3ffe6020f27f21c026302ed438039442d84afd9c6c7db56ab6a
-
SSDEEP
1536:zvXObzfMmFJA4r0BOQA8AkqUhMb2nuy5wgIP0CSJ+5yFB8GMGlZ5G:zvXOnkmw4rdGdqU7uy5w9WMyFN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
pid process 2320 [email protected] -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1724 cmd.exe 1724 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
bc14581d4ca447782ee7abc0d8465f5d90f4deadc7f2df981ab5aa3ad353ffb7.execmd.exedescription pid process target process PID 1924 wrote to memory of 1724 1924 bc14581d4ca447782ee7abc0d8465f5d90f4deadc7f2df981ab5aa3ad353ffb7.exe cmd.exe PID 1924 wrote to memory of 1724 1924 bc14581d4ca447782ee7abc0d8465f5d90f4deadc7f2df981ab5aa3ad353ffb7.exe cmd.exe PID 1924 wrote to memory of 1724 1924 bc14581d4ca447782ee7abc0d8465f5d90f4deadc7f2df981ab5aa3ad353ffb7.exe cmd.exe PID 1924 wrote to memory of 1724 1924 bc14581d4ca447782ee7abc0d8465f5d90f4deadc7f2df981ab5aa3ad353ffb7.exe cmd.exe PID 1724 wrote to memory of 2320 1724 cmd.exe [email protected] PID 1724 wrote to memory of 2320 1724 cmd.exe [email protected] PID 1724 wrote to memory of 2320 1724 cmd.exe [email protected] PID 1724 wrote to memory of 2320 1724 cmd.exe [email protected]
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc14581d4ca447782ee7abc0d8465f5d90f4deadc7f2df981ab5aa3ad353ffb7.exe"C:\Users\Admin\AppData\Local\Temp\bc14581d4ca447782ee7abc0d8465f5d90f4deadc7f2df981ab5aa3ad353ffb7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]Filesize
79KB
MD59ae0fe65a0ee3a79dfb82bfdd663bf74
SHA1d675337d9292c9cf6192192207a1973b9f066ae1
SHA25610dd7f8d483987740689b7ec2cd25686ff2e2a46371e2867e6cff1ae5f2e7f98
SHA512255c944a26b48b8483e33f22b64f20026bed38774e93d7f929ebcd18a2d4b3cb7bb5aa4416cf2bd088be96d9bef47f2ccf4206b4c51f9bb8c43ab6456e68ea35
-
memory/1924-8-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2320-7-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB