Resubmissions

01-06-2024 04:50

240601-fgcxmsad7w 8

01-06-2024 04:46

240601-feb8bsac9y 9

Analysis

  • max time kernel
    136s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01-06-2024 04:46

General

  • Target

    u237cgatAh2.exe

  • Size

    5.6MB

  • MD5

    0e2c1ee8e6bdb339094ec24026a01e20

  • SHA1

    449972cb63e21bf25d03ad1e85cf87af97c75a2e

  • SHA256

    ffe104f44b6a84074e2305fba55c1cb777446d1dace44c23eaf873536dcc542f

  • SHA512

    c0a71a9d796802bdf7110c8f69ebdaeb9c968df69b41a8bc1ff52f3a4082f40df93085ec278863acc93763ca11114b4eac5278db136540be0bea67aa93c607c5

  • SSDEEP

    98304:6s2vdJmvMwJ2liHiHeCJ+46C2m0B/YMh6FuLChc4n5Gc6jLq:6pdJK/46iHu4525Vh6FuLChRn5l6j2

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\u237cgatAh2.exe
    "C:\Users\Admin\AppData\Local\Temp\u237cgatAh2.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\u237cgatAh2.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\u237cgatAh2.exe" MD5
        3⤵
          PID:2624
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:2628
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:2648
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c CLS
            2⤵
              PID:2096
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session not found. Use latest code. You can only have app opened 1 at a time. && timeout /t 5"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1652
              • C:\Windows\system32\cmd.exe
                cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session not found. Use latest code. You can only have app opened 1 at a time. && timeout /t 5"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2908
                • C:\Windows\system32\timeout.exe
                  timeout /t 5
                  4⤵
                  • Delays execution with timeout.exe
                  PID:2136
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 1704 -s 8392
              2⤵
                PID:3028

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1704-0-0x0000000077590000-0x0000000077592000-memory.dmp

              Filesize

              8KB

            • memory/1704-6-0x000000013FEC8000-0x0000000140269000-memory.dmp

              Filesize

              3.6MB

            • memory/1704-4-0x0000000077590000-0x0000000077592000-memory.dmp

              Filesize

              8KB

            • memory/1704-2-0x0000000077590000-0x0000000077592000-memory.dmp

              Filesize

              8KB

            • memory/1704-10-0x000000013FE30000-0x0000000140808000-memory.dmp

              Filesize

              9.8MB

            • memory/1704-11-0x000000013FEC8000-0x0000000140269000-memory.dmp

              Filesize

              3.6MB

            • memory/1704-12-0x000000013FE30000-0x0000000140808000-memory.dmp

              Filesize

              9.8MB

            • memory/1704-13-0x000000013FE30000-0x0000000140808000-memory.dmp

              Filesize

              9.8MB