90cadc623a0469553ba745041046fce1bf03e2fbbc806216ff4b5a5afa903213

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Dh-A.4228.5280.exe
Size 13KB
Sample240602-197ypsab83
SHA256 90cadc623a0469553ba745041046fce1bf03e2fbbc806216ff4b5a5afa903213
MD5 abe52f44c41124a51c021082b265e07a
SHA1 5011a133842797e4235995d501d329674eb80ad1
SHA512 cebe2356285107483c0492d3f569db3a44d7e8aef0236859c809cbec553c0f5e847f6a3ec7e2aba473e8ea79690c989fae4687a79d81122548d03ae3afff3782
SSDEEP 192:/vQT5gpIJMg6JOWRKPtIDCJ+CCy9IRz9VpH+Bvi1WlJdxqHiYrq:QqCSEWzeC94K1WlJj+
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
4520	240602222211454.exe
4920	240602222223048.exe
744	240602222233126.exe
4824	240602222244142.exe
4532	240602222254345.exe
4544	240602222304704.exe
60	240602222315392.exe
4420	240602222326579.exe
4268	240602222339220.exe
2948	240602222351439.exe
4980	240602222404767.exe
3296	240602222418907.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4224	4436	SecuriteInfo.com.Win32.Dh-A.4228.5280.exe	93
PID 4436 wrote to memory of 4224	4436	SecuriteInfo.com.Win32.Dh-A.4228.5280.exe	93
PID 4224 wrote to memory of 4520	4224	cmd.exe	94
PID 4224 wrote to memory of 4520	4224	cmd.exe	94
PID 4520 wrote to memory of 452	4520	240602222211454.exe	95
PID 4520 wrote to memory of 452	4520	240602222211454.exe	95
PID 452 wrote to memory of 4920	452	cmd.exe	96
PID 452 wrote to memory of 4920	452	cmd.exe	96
PID 4920 wrote to memory of 3756	4920	240602222223048.exe	98
PID 4920 wrote to memory of 3756	4920	240602222223048.exe	98
PID 3756 wrote to memory of 744	3756	cmd.exe	99
PID 3756 wrote to memory of 744	3756	cmd.exe	99
PID 744 wrote to memory of 4264	744	240602222233126.exe	101
PID 744 wrote to memory of 4264	744	240602222233126.exe	101
PID 4264 wrote to memory of 4824	4264	cmd.exe	102
PID 4264 wrote to memory of 4824	4264	cmd.exe	102
PID 4824 wrote to memory of 1704	4824	240602222244142.exe	103
PID 4824 wrote to memory of 1704	4824	240602222244142.exe	103
PID 1704 wrote to memory of 4532	1704	cmd.exe	104
PID 1704 wrote to memory of 4532	1704	cmd.exe	104
PID 4532 wrote to memory of 4340	4532	240602222254345.exe	105
PID 4532 wrote to memory of 4340	4532	240602222254345.exe	105
PID 4340 wrote to memory of 4544	4340	cmd.exe	106
PID 4340 wrote to memory of 4544	4340	cmd.exe	106
PID 4544 wrote to memory of 4664	4544	240602222304704.exe	108
PID 4544 wrote to memory of 4664	4544	240602222304704.exe	108
PID 4664 wrote to memory of 60	4664	cmd.exe	109
PID 4664 wrote to memory of 60	4664	cmd.exe	109
PID 60 wrote to memory of 4304	60	240602222315392.exe	110
PID 60 wrote to memory of 4304	60	240602222315392.exe	110
PID 4304 wrote to memory of 4420	4304	cmd.exe	111
PID 4304 wrote to memory of 4420	4304	cmd.exe	111
PID 4420 wrote to memory of 4908	4420	240602222326579.exe	119
PID 4420 wrote to memory of 4908	4420	240602222326579.exe	119
PID 4908 wrote to memory of 4268	4908	cmd.exe	120
PID 4908 wrote to memory of 4268	4908	cmd.exe	120
PID 4268 wrote to memory of 908	4268	240602222339220.exe	121
PID 4268 wrote to memory of 908	4268	240602222339220.exe	121
PID 908 wrote to memory of 2948	908	cmd.exe	122
PID 908 wrote to memory of 2948	908	cmd.exe	122
PID 2948 wrote to memory of 2904	2948	240602222351439.exe	123
PID 2948 wrote to memory of 2904	2948	240602222351439.exe	123
PID 2904 wrote to memory of 4980	2904	cmd.exe	124
PID 2904 wrote to memory of 4980	2904	cmd.exe	124
PID 4980 wrote to memory of 2296	4980	240602222404767.exe	128
PID 4980 wrote to memory of 2296	4980	240602222404767.exe	128
PID 2296 wrote to memory of 3296	2296	cmd.exe	129
PID 2296 wrote to memory of 3296	2296	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Dh-A.4228.5280.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Dh-A.4228.5280.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240602222211454.exe 000001
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Users\Admin\AppData\Local\Temp\240602222211454.exe
    C:\Users\Admin\AppData\Local\Temp\240602222211454.exe 000001
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240602222223048.exe 000002
      4⤵
      Suspicious use of WriteProcessMemory
      PID:452
    - - C:\Users\Admin\AppData\Local\Temp\240602222223048.exe
        
        C:\Users\Admin\AppData\Local\Temp\240602222223048.exe 000002
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4920
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240602222233126.exe 000003
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\240602222233126.exe
        
        C:\Users\Admin\AppData\Local\Temp\240602222233126.exe 000003
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240602222244142.exe 000004
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\240602222244142.exe
        
        C:\Users\Admin\AppData\Local\Temp\240602222244142.exe 000004
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240602222254345.exe 000005
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\240602222254345.exe
        
        C:\Users\Admin\AppData\Local\Temp\240602222254345.exe 000005
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240602222304704.exe 000006
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\240602222304704.exe
        
        C:\Users\Admin\AppData\Local\Temp\240602222304704.exe 000006
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240602222315392.exe 000007
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\240602222315392.exe
        
        C:\Users\Admin\AppData\Local\Temp\240602222315392.exe 000007
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240602222326579.exe 000008
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\240602222326579.exe
        
        C:\Users\Admin\AppData\Local\Temp\240602222326579.exe 000008
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240602222339220.exe 000009
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\240602222339220.exe
        
        C:\Users\Admin\AppData\Local\Temp\240602222339220.exe 000009
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240602222351439.exe 00000a
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\240602222351439.exe
        
        C:\Users\Admin\AppData\Local\Temp\240602222351439.exe 00000a
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240602222404767.exe 00000b
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\240602222404767.exe
        
        C:\Users\Admin\AppData\Local\Temp\240602222404767.exe 00000b
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240602222418907.exe 00000c
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\240602222418907.exe
        
        C:\Users\Admin\AppData\Local\Temp\240602222418907.exe 00000c
        25⤵
        Executes dropped EXE
        
        PID:3296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

240602222211454.exe

Path C:\Users\Admin\AppData\Local\Temp\240602222211454.exe
Size 12KB
SHA256 72557a87da39df0d46cfbc62ec4d31451f271b72907da545fd51bf5f8806de2f
MD5 4edb848317f07ce6e73584dd26d2a223
SHA1 0a04d1e7f8e67742503946866a5b40dea82473f5
SHA512 fbb092ec8a4e305dfef2da4494426809aa24d8bf97806a561653e8d25512e4acd26b4bf1e49833eb3f1546c32c3c8bc3ce73e6b6800fe6b786195af59b34a0a4
SSDEEP 192:F94T56NEtBi76XYETEZchOfD8zfIvsTtJGCTWRemoJWwWlJdxqHbrgn:Qhge5SugYt6LeWwWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240602222223048.exe

Path C:\Users\Admin\AppData\Local\Temp\240602222223048.exe
Size 12KB
SHA256 71762a3ecf09cf9791d1e3b02a0b1461d60c25fff2a003067a69ff80ab54d91e
MD5 cb529e58fecc59d5b82f714e6fc03df0
SHA1 10d23c6b290f2e8baa9c7401b39f4b4ecc119406
SHA512 b398c56d19e2706707fcbbd81aa03d27b932782406659ba0864dd8f280bc3fbfe5eb82b1ab56a50791729d6b055b5c1672a1cd38af0dab49345ee947c3259c75
SSDEEP 192:+4z2T5pYqPr8y6yCgo30j+goKwNVLK/7NyhwfOpCh3GWlJdxqHLHQQ:m0CwQvozVuS/Qh3GWlJj+H
MD5 SHA1 SHA512 SSDEEP

Submit Download

240602222233126.exe

Path C:\Users\Admin\AppData\Local\Temp\240602222233126.exe
Size 12KB
SHA256 00c1f3152fdd63b51bb33b9983d1c00c7fd856a6dc9df2f99af7902b66e89671
MD5 2ba2714834a131f32347f8154b1ec7ba
SHA1 d1adeb7f5bb9943e00ca5297dc464cd27cc6364f
SHA512 cecccbd94fecbaf153bf48ec2c641efbe704447eb90a4d1e6e2f383f69725bd2836abc8b883d7bd9498a9c5dfd255124d3b401fdc2c6031431ce174bea3dde3e
SSDEEP 192:k94T56Kt8i76XYETEZchOfD8zfIvsTtJGCdO1RfmoRWlJdxqHAn:JB/e5SugYtO+oRWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240602222244142.exe

Path C:\Users\Admin\AppData\Local\Temp\240602222244142.exe
Size 12KB
SHA256 5c1afe4860501cdf13246abda727c9a4d865f05a0f78bde0cd8c988d7231c9d2
MD5 e2bcdd8e20df3635f632a6cb53972b74
SHA1 5c5baaa14b601b06407d55dfd25cd75123cf8ddf
SHA512 3dee56e0207e8207002f9c5ba4a23627c944c06424640e452f2849cece69ede61fd02d20d9e124c2ffe2e9623b5f9b6f5597f9c905a3754a15147acd804f51ff
SSDEEP 192:9GCT5EyoLWST6XWIPpLRIZTUlvCwPwoz05a7GFGzxWlJdxqHbr4:n2zLdP6la46FGWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240602222254345.exe

Path C:\Users\Admin\AppData\Local\Temp\240602222254345.exe
Size 12KB
SHA256 f48121a343288ac4aceb1d679e60248fedf932a57e9d277326768f0b016a20ff
MD5 8b71a654a62dc6d2969ca63e8a52d00d
SHA1 0fb264e37b2831071bec6e865448cae535cfe89f
SHA512 6e7e10377c6fa276617229f6c313b62386ea3fee5f6c22fbb4ece90c631ae6714c818e9b2ea53c4b6f566387ce632b28ba0e4760844e05cb552bc61c9b5f53b2
SSDEEP 192:7VA4T53iQGalyj6IkvUc526v8kUAtgvFgUCHjuGw1SLWlJdxqHT9:C4pwEHj73WlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240602222304704.exe

Path C:\Users\Admin\AppData\Local\Temp\240602222304704.exe
Size 12KB
SHA256 b504e3377c14cf4f5767bdd28d4292633964616864376f6991559af349f3e22b
MD5 01f2462a9c151dc89d4d9d20efc51f4c
SHA1 baef0fc04ae1da2c7fe42d79b64f78a1926f6604
SHA512 cd0e3fcbbd3ee6676b0942616e68620dc316f1df7dff06c6d18d840c77421df84fbe5be64ae7d55e76efbea41a89d7e266277b8b18920a131818320650bbfaa0
SSDEEP 192:Ra7T5LInpVnBSV962/0w2pLiDVZz5QSNd5sk5ltG2Xx5WlJdxqHkVf:yYVgVnTl5CsWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240602222315392.exe

Path C:\Users\Admin\AppData\Local\Temp\240602222315392.exe
Size 13KB
SHA256 6d730ba20bd57ffec1eb0c618724662966dd68f680e41610cc06102d938623fd
MD5 b52c368a91837d943f3a85f928890dc6
SHA1 0d848fddab373c0b6bd74bc9afd8add04db21d8d
SHA512 1096a02f58da2e6039d94d725aa8130b4105561a8ffa64c8ca0ed502f95d75e3e1501fd9c461f149aafcef301252d942af0fe681f0fdb7e2f742464666788bd1
SSDEEP 192:DBfPT5E+o5Tup6QXzSavpdurVGfe7694fwDkcjMXI7h1QjyjDl7Dl1WlJdxqHgrv:DdG/5qMxC4Yr2Ojh7h1WlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240602222326579.exe

Path C:\Users\Admin\AppData\Local\Temp\240602222326579.exe
Size 13KB
SHA256 191d521b442bebd12c22048112f2a345af142b8783a0b6f6e52063e51af8441c
MD5 f05600e2d97b8df8ba36a75f49889d95
SHA1 4b44dd7f84886f4270298006b418270940f53d66
SHA512 64f0f276a251ab922dd74000d1f8c7855384764d172dc8a73a6c7a9bf1c8a165d6c68e234fd399a3f01d012a6eecb6e19cfbcac21846bdfd18ce258ff1bdc553
SSDEEP 192:u67T5z3eSsC16Am3eQGiwzJqN8/HCotSTKhExVMJ1tGz59R596WlJdxqHgrh:tVersPmhKyEWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240602222339220.exe

Path C:\Users\Admin\AppData\Local\Temp\240602222339220.exe
Size 12KB
SHA256 2d048ba4f025f18a0e537d05e8e54c35d27dae63df7cc7d848bf825ba824ef06
MD5 a8bd3db1f4e9b1952b0b8ed5f308611d
SHA1 8f1f96fe965b3cf2eec0e0fc47f19c730c1d4bc4
SHA512 854c96d4ddabc040e5621a0012d60c3d6add3f2775ae25b723e056a64da62787b004744204ea4d35c84c0dd663e0e267728370c348168f2f4ae23c60ef0d6667
SSDEEP 192:zG8T5QHShzRST6IkRHqWOuD3RKA8aN//GBSIsPjpYmGDWlJdxqHUy:/2Iwq/XknzDWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240602222351439.exe

Path C:\Users\Admin\AppData\Local\Temp\240602222351439.exe
Size 13KB
SHA256 e12f2ec0ac9cc90c9fc1caa2acee64eb0994ba486228ccc7360ed80304e1778c
MD5 ac1836919bf7caf107b691e6ddce0040
SHA1 26c9cf5ff907bd6937d7cba83bdd590dd14ad63d
SHA512 3b0d842d9495fa81a3dfd595e469aba79a34f42b79fd4e715a42c24e13f2c3b6c48226d3d8874ba1fa0a9cb5659577683c42818bedae8ec4fc58ff0b94d5ee03
SSDEEP 192:x67T5zneqsC16Am3eQGiwzJqN8/HCo+iNIX3FKHHJLG7GoWlJdxqHiYrv9:+1eDsPmhozK7GoWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240602222404767.exe

Path C:\Users\Admin\AppData\Local\Temp\240602222404767.exe
Size 12KB
SHA256 250394a10122e476bce609306cf62c824f62b1a5181a926a7d2a20b110d4b4d3
MD5 e04cfcf677b70cf226540e3a341f4e03
SHA1 b92177fdc32631d31a599037f5d11930fab376c6
SHA512 e1625b3493e543ac586cda0bfb7a179ad55829ef5c4aa6ebee9f2480266c14cd63af90494ba53be48bb91c8ac0204c9542a3fa229b47dc4a765c0c4fdb5398f7
SSDEEP 192:wcw1OyT5LEZy66v3i3j0ToGRv8AGA9ny7LQ1qNWpgG17R7SWlJdxqH6W:wN64gyhtn+ggY9SWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240602222418907.exe

Path C:\Users\Admin\AppData\Local\Temp\240602222418907.exe
Size 12KB
SHA256 ded66e254311a46e1a1dbd870ce144b503591caa4dda68f206c40a792be43e5b
MD5 61b5ff674bb3d95f92741c97d727140d
SHA1 753a335cd255aa3aff9f916b80edb4c53e5a2c42
SHA512 39c2bda80021a032e90c1d34da6f19133aaad9204088828a896bbfd718c501d5c88d0b58164c54e829bf76b95ab8a3482019d1f863e3b002b2dae8a7302d97a6
SSDEEP 192:h+j7T5ODC+yD63wmJLSoZVdn4kJcefdLy8u2JlNpgYltWlJdxqHbrEJ:SOCFYukWOJtgMWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads