Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 21:01
Static task
static1
Behavioral task
behavioral1
Sample
46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
General
-
Target
46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb.exe
-
Size
66KB
-
MD5
0100329c480085c80165fb680a087043
-
SHA1
6b089166dacb9b61e759c7dfe7bdf947eb8d2160
-
SHA256
46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb
-
SHA512
501fc369b0aafe7542266e3ba6e84014f2f082fde7b91ad834464ada07c65c2d4bcd02b157c33e5240d522cf9fc4703321d03f4b48b470129c371a2c20d64206
-
SSDEEP
768:iLxqBt1sJw5pVNUP1/kvtbWcpmCKXHak3QIXjLZJ2bXfqQKMq+gjTAfu/MB8QKpi:1teqYQIXJJyXEv/MBK6vRel1ewE
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2680 eanhoceah-atexú±¬± 4104 eanhoceah-atexú±¬± -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\eanhoceah-atexú±¬± 46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb.exe File created C:\Windows\SysWOW64\eanhoceah-atexú±¬± 46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb.exe File opened for modification C:\Windows\SysWOW64\orxevoofú°¸¸ eanhoceah-atexú±¬± File created C:\Windows\SysWOW64\orxevoofú°¸¸ eanhoceah-atexú±¬± File opened for modification C:\Windows\SysWOW64\eanhoceah-atexú±¬± eanhoceah-atexú±¬± -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 4104 eanhoceah-atexú±¬± 4104 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± 2680 eanhoceah-atexú±¬± -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3740 wrote to memory of 2680 3740 46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb.exe 82 PID 3740 wrote to memory of 2680 3740 46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb.exe 82 PID 3740 wrote to memory of 2680 3740 46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb.exe 82 PID 2680 wrote to memory of 4104 2680 eanhoceah-atexú±¬± 83 PID 2680 wrote to memory of 4104 2680 eanhoceah-atexú±¬± 83 PID 2680 wrote to memory of 4104 2680 eanhoceah-atexú±¬± 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb.exe"C:\Users\Admin\AppData\Local\Temp\46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\eanhoceah-atexú±¬±"C:\Windows\system32\eanhoceah-atexú±¬±"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\eanhoceah-atexú±¬±ùù¿çç¤3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4104
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5e1b3cb8a0ae4f7c7428028dc68fe7089
SHA1ac1f2dcc3696f76749c3f4c1e6adaf03adeb6333
SHA256aa84a35c0d83bd8e3de17ef94d4ad407461cb4fbaacd9034780cbcffd08cba3c
SHA5124de3568269ef7b165d6812e4908f75f9d07691ef975706a9d5c2ba772432321ed2ce4fd717b3d7e2d585767721a289fb83d89110aaf72ea0d8fdfc7debfdbe91
-
Filesize
5KB
MD548c45e05569f9a5665d082fbdc116c14
SHA1e491ab1327b88312fc6d0535621b6de733c8efb5
SHA2567e916f847bb5de3e09b36bd527e09ed656df13296bdcd9924185bcccde7dbe4c
SHA512e1cc47e185831dc6c40372efc227f299964f262c641b790d31f0fe452a5bc70a4946c689913504c64790833c131d40c01fcd9ff3a148636be9f502959f7cc49c