55e0eb38cd787ec572e211fb205938eb9132a3fa3e463792623c78de56495cde

Analysis

max time kernel
130s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Dh-A.1603.8728.exe
Size 13KB
Sample240603-bth7zaec4y
SHA256 55e0eb38cd787ec572e211fb205938eb9132a3fa3e463792623c78de56495cde
MD5 5f4a8153a8a96c1bbcdafa891695a6bc
SHA1 a74c3a3e2b986dd00e4c69a57ee2572f7879a2ef
SHA512 3b9439fd9c28b3ba2410d0a5901309425a4808e2a0bfb7a8dc5f298ae305ae0f72f69dc72342ddd2b060a11de328ae76db146a74cd534b10331240a28c8e3700
SSDEEP 192:SjTT5vIEOM2/6JUaw1PdrVYCJeCfnL4Wj9NnKRHuD01RB+LiE/WlJdxqHXYrCyi:C+4u++q2lmE/WlJj+
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
3804	240603012606386.exe
3012	240603012616589.exe
400	240603012626402.exe
4848	240603012638683.exe
2564	240603012649855.exe
5096	240603012704402.exe
2392	240603012714761.exe
4956	240603012729339.exe
3176	240603012742667.exe
4672	240603012756714.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1996	4272	SecuriteInfo.com.Win32.Dh-A.1603.8728.exe	90
PID 4272 wrote to memory of 1996	4272	SecuriteInfo.com.Win32.Dh-A.1603.8728.exe	90
PID 1996 wrote to memory of 3804	1996	cmd.exe	91
PID 1996 wrote to memory of 3804	1996	cmd.exe	91
PID 3804 wrote to memory of 4256	3804	240603012606386.exe	92
PID 3804 wrote to memory of 4256	3804	240603012606386.exe	92
PID 4256 wrote to memory of 3012	4256	cmd.exe	93
PID 4256 wrote to memory of 3012	4256	cmd.exe	93
PID 3012 wrote to memory of 1520	3012	240603012616589.exe	95
PID 3012 wrote to memory of 1520	3012	240603012616589.exe	95
PID 1520 wrote to memory of 400	1520	cmd.exe	96
PID 1520 wrote to memory of 400	1520	cmd.exe	96
PID 400 wrote to memory of 2940	400	240603012626402.exe	97
PID 400 wrote to memory of 2940	400	240603012626402.exe	97
PID 2940 wrote to memory of 4848	2940	cmd.exe	98
PID 2940 wrote to memory of 4848	2940	cmd.exe	98
PID 4848 wrote to memory of 4980	4848	240603012638683.exe	99
PID 4848 wrote to memory of 4980	4848	240603012638683.exe	99
PID 4980 wrote to memory of 2564	4980	cmd.exe	100
PID 4980 wrote to memory of 2564	4980	cmd.exe	100
PID 2564 wrote to memory of 2708	2564	240603012649855.exe	101
PID 2564 wrote to memory of 2708	2564	240603012649855.exe	101
PID 2708 wrote to memory of 5096	2708	cmd.exe	102
PID 2708 wrote to memory of 5096	2708	cmd.exe	102
PID 5096 wrote to memory of 3044	5096	240603012704402.exe	103
PID 5096 wrote to memory of 3044	5096	240603012704402.exe	103
PID 3044 wrote to memory of 2392	3044	cmd.exe	104
PID 3044 wrote to memory of 2392	3044	cmd.exe	104
PID 2392 wrote to memory of 4964	2392	240603012714761.exe	105
PID 2392 wrote to memory of 4964	2392	240603012714761.exe	105
PID 4964 wrote to memory of 4956	4964	cmd.exe	106
PID 4964 wrote to memory of 4956	4964	cmd.exe	106
PID 4956 wrote to memory of 5044	4956	240603012729339.exe	107
PID 4956 wrote to memory of 5044	4956	240603012729339.exe	107
PID 5044 wrote to memory of 3176	5044	cmd.exe	108
PID 5044 wrote to memory of 3176	5044	cmd.exe	108
PID 3176 wrote to memory of 1796	3176	240603012742667.exe	109
PID 3176 wrote to memory of 1796	3176	240603012742667.exe	109
PID 1796 wrote to memory of 4672	1796	cmd.exe	110
PID 1796 wrote to memory of 4672	1796	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Dh-A.1603.8728.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Dh-A.1603.8728.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012606386.exe 000001
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Users\Admin\AppData\Local\Temp\240603012606386.exe
    C:\Users\Admin\AppData\Local\Temp\240603012606386.exe 000001
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012616589.exe 000002
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\240603012616589.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012616589.exe 000002
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3012
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012626402.exe 000003
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\240603012626402.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012626402.exe 000003
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012638683.exe 000004
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\240603012638683.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012638683.exe 000004
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012649855.exe 000005
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\240603012649855.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012649855.exe 000005
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012704402.exe 000006
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\240603012704402.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012704402.exe 000006
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012714761.exe 000007
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\240603012714761.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012714761.exe 000007
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012729339.exe 000008
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\240603012729339.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012729339.exe 000008
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012742667.exe 000009
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\240603012742667.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012742667.exe 000009
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012756714.exe 00000a
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\240603012756714.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012756714.exe 00000a
        21⤵
        Executes dropped EXE
        
        PID:4672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

240603012606386.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012606386.exe
Size 13KB
SHA256 6bc1d9170f3cc0a1dd128ec468db4c645e07ab23dfd1a5138e73fbc871c2eece
MD5 13bc993057e13cbd55436185c053a11c
SHA1 1a7ac203bce0cfcf7d127a9fee64d136bf53a0dd
SHA512 605c41f9ed9078fe507990aae9086de8c5b279707125994e37ab25ad9ae987871678840cd600742165827c122161f24db2f7cda61ba50bbe8d653b467ef8a466
SSDEEP 192:ORy2CT5Eo3hMY6AwrCCPdtTypWyEP60UB1lveavDMO7syEsWlJdxqHmPpM:iCPqswjGEOzdpEsWlJj+KM
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012616589.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012616589.exe
Size 12KB
SHA256 166fcc2b1455d5ec854471c99bc9886b9723654aacc4b2304e40f4142ef93a4c
MD5 c37d58d9d60cc9832e888bb7621b7457
SHA1 1d3a87ea7634696d1b75f16cd2138f6e3d1fd41d
SHA512 349e88cad115676d0dc0176ea10188c20679017bdd1b309a393c27e1c3ebed72c13e5fea40745f618d711f538d98e5e5b83bf8d7f5f84aa0b2dd7c8157ec17b2
SSDEEP 192:0tk1T5qYwtIir64rEopcez7m2M8AWc4lxmmcWlJdxqHf:pxejcMTcWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012626402.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012626402.exe
Size 13KB
SHA256 19fd58a23d820660c08366de9febc04cb5d0f6a9e8c56c9d73ae9d39aece99a9
MD5 cb76cdbac1e26da7f814f12ab78c28ea
SHA1 4211b64c054864753959ef76da79c04e1618c4a3
SHA512 0aa0179b363edc60a252fcd0a374a4af3aeeaf9595a5194f7b0ec74316613b42b9dbde3d63c38a483dbd73d7e89e7bd7f550aa869af8604510d1aa039a03af65
SSDEEP 192:UsmphT5dcNpsb6Hk+PZ7q89nqK7o+r+gGEJrnmaWlJdxqHXAz:M4cc9xJrmaWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012638683.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012638683.exe
Size 12KB
SHA256 23d85cfcbc99f459658ebac1b5cb3f8b4f898d4e9372da3d893b12b637ca3fb8
MD5 581267c08acbafde74de28a92f5d7e4b
SHA1 c68cad6761d87afc378787a353ed22463acaeab0
SHA512 927450256b45c768f4e7593bad3b32338588ae8a8b840e50aa55f0ba98af27dfb7dfef4fc7d860a91e76d0727ea3aeec5be441a7109ee55713ace7c76483c7ad
SSDEEP 192:DlrT5Qnk0jSz6PkhYkT5jCUIBP8URlkO1PEmGn1H5H6WlJdxqHiYrrHm:xF0u9uBaTzuWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012649855.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012649855.exe
Size 12KB
SHA256 30d5c857c2083f7d5dbe641c2c5ed80b4490221b87b0526fbb3298d71bf6c56b
MD5 cc8993503750ca2294a992e0fb6154cb
SHA1 4071fbd3899a778a4f7a953d4d94da5a2ca49614
SHA512 bf0f1ea8332e517ddcdca798b37ddeac001bd264d2fe5080a5b5003e8a065573535ea8d43d3f2fc5d98c71d8ba7cf06b026234a7e35c8abe5ba6f4f009cdc09f
SSDEEP 192:/1hrT5tLOfJir6HA/Zba73tq7DaSzve80AF7mqRap7ppWlJdxqHiLIF:dJfEoRfaq81pWlJj+FF
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012704402.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012704402.exe
Size 12KB
SHA256 2947fc195538a6a8a7e049a1f0ab5a3c632e1d418d81fc6e03dbefe4346f4e7d
MD5 9e6b7b4dc5266390ec6e7b1319cd6388
SHA1 5eed4eb929f30c3013248bb047b2cae58bad6663
SHA512 790952ed88fdfc6211fc2c80af9ec149279bb05829361a61751af84c7799de58092eb467a9470a7fab7da45b5ca7be8a983b43127cfc1ebf055d3f62c6bf100f
SSDEEP 192:CVrT53iQGaNyj6IkvUc526v8kbAtzEblzdjmG/13cWlJdxqHlVT:8ZYEhLjTuWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012714761.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012714761.exe
Size 13KB
SHA256 3ba9dccd73689245ebd342775c0cc47c94e5a7a5ca996efe90b3fe72d370022b
MD5 131ab82306efa6a94fc7d168c4982511
SHA1 debb1f89adde081d3bca88b8204b901d01b31662
SHA512 a9294e76a583a6d59838d12612f2a426951a742add91c8e10d28047783dd81f86dbc454df4b94b4b4794096e520a6791539836c9b9896e70a5c4d108f439f384
SSDEEP 192:0Hy7T5tui9fML6yAbvnZ85NmnlaS037nxmwTmaRkWlJdxqHgr+Q:CArB9kMKyayWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012729339.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012729339.exe
Size 12KB
SHA256 60cc308d1ac3f80547c3688caa626482c6e4574375b8e458ad67b8a5946ebcf0
MD5 3191a7ac8e4f8dbe658ab0936fe26273
SHA1 509a45c53f15623ad419001610469d68bc0c44bb
SHA512 b9a6c7b230383c7116cbaffc6c22a66c1aac054f7b9ecee4e98eb60651df4f1efa6f22e59f555c8838f61588f76884e41f6439f448a03aba376f4be863ad9c36
SSDEEP 192:03VoT5SIGCkyj6i3i3uDxcu76l81A9RBpZ5uIKkxQvGdLJvzWlJdxqHbVz:0yZGCH3o+6BBsgQuzvzWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012742667.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012742667.exe
Size 12KB
SHA256 4f3fa924d9a3f322dc94167160276103b1576cc66716563b96734e4e36c81be3
MD5 2130a83c3135b7bca32f2f2d04dc2ae5
SHA1 47dc4adc23ece49d804680674bf12911eebf31aa
SHA512 2acff455a332dd263f66da9f9d87d1d31f6e8ecea4d7c62b38a2b0fe5ed36aec224b4eb295dc56a031ed5f6de52b3789c9c22d17304dcf643353771bb091e8f3
SSDEEP 192:Y1OyT5LEcky66v3i3j0ToGRv8AGA9ny7LyQrSgWepg41kxWlJdxqHiH:eacXgyhtn0CIg3WlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012756714.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012756714.exe
Size 12KB
SHA256 197c1e9dcb366b1ed9b31aa92d68f3fc7c7ab71427d584f6981a8dac1d653e35
MD5 dadf408af285fa1579f28a1ac5f5f3d6
SHA1 b2b680de475d799c0884eae74ebe449ba2b9dcb3
SHA512 aaebf5c1d4c3c51901e590054384d1c35ea198e3c2abc7dd3abf5b2a8bf1695d5f508a31bf8adf5e084d06b2ce706d084878827cf40d9df71945651a99031180
SSDEEP 192:GNvT5dkC8sq6yVk1YLTdXgIFrQzuCtnf+t2G7WlJdxqHr:kkck27WqyD7WlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads