Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
b27dde44e585fd60fda53992f5633ee7749f80c82df6f79d04a81c6865576fb2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b27dde44e585fd60fda53992f5633ee7749f80c82df6f79d04a81c6865576fb2.exe
Resource
win10v2004-20240508-en
General
-
Target
b27dde44e585fd60fda53992f5633ee7749f80c82df6f79d04a81c6865576fb2.exe
-
Size
55KB
-
MD5
270eca305a2faccf90ef9aa8e5e4f99c
-
SHA1
9c1a3e250be122b6957f76b1a3d1173ee2404c73
-
SHA256
b27dde44e585fd60fda53992f5633ee7749f80c82df6f79d04a81c6865576fb2
-
SHA512
3841f6d8e26215b6947ffce90790c26bcfa4c5da6ea0d4b9e4b07f9281881dc736ada958e3c9b8a0a98bda4e91ed04e02e318db49da8794384e7f3f0ed0843eb
-
SSDEEP
768:vCru/f9Uw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRWTWIReOOB:7RTzy48untU8fOMEI3jyYfPWpOB
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2836 1952 b27dde44e585fd60fda53992f5633ee7749f80c82df6f79d04a81c6865576fb2.exe 29 PID 1952 wrote to memory of 2836 1952 b27dde44e585fd60fda53992f5633ee7749f80c82df6f79d04a81c6865576fb2.exe 29 PID 1952 wrote to memory of 2836 1952 b27dde44e585fd60fda53992f5633ee7749f80c82df6f79d04a81c6865576fb2.exe 29 PID 1952 wrote to memory of 2836 1952 b27dde44e585fd60fda53992f5633ee7749f80c82df6f79d04a81c6865576fb2.exe 29 PID 2836 wrote to memory of 2164 2836 cmd.exe 30 PID 2836 wrote to memory of 2164 2836 cmd.exe 30 PID 2836 wrote to memory of 2164 2836 cmd.exe 30 PID 2836 wrote to memory of 2164 2836 cmd.exe 30 PID 2164 wrote to memory of 1096 2164 iexpress.exe 31 PID 2164 wrote to memory of 1096 2164 iexpress.exe 31 PID 2164 wrote to memory of 1096 2164 iexpress.exe 31 PID 2164 wrote to memory of 1096 2164 iexpress.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\b27dde44e585fd60fda53992f5633ee7749f80c82df6f79d04a81c6865576fb2.exe"C:\Users\Admin\AppData\Local\Temp\b27dde44e585fd60fda53992f5633ee7749f80c82df6f79d04a81c6865576fb2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\2942.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\b27dde44e585fd60fda53992f5633ee7749f80c82df6f79d04a81c6865576fb2.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:1096
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
55KB
MD51f115c23afc7b10f34aefab3ec3322b8
SHA1283a6a4ec4d7a25648221ce3b3a0d175880d8513
SHA25698c9b9399195e818ea5d51d8ed6ffe7c0da885f3d946f1060b88f0578db84cba
SHA51282c17a48755c9db7eafbe2a39327a8dcddad2031fd2ae0dccdc76ca6834022bb6958f1dd6ae1dfc2f52e45c1c60b8bd3adef72d49f1b4377b06dbb8f24752357
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083