549429951f8c2d55d584fc9a2b7f978eb86ad59f02edc4d969aab61bb9588246

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Dh-A.15732.18153.exe
Size 13KB
Sample240603-bthlfaec4v
SHA256 549429951f8c2d55d584fc9a2b7f978eb86ad59f02edc4d969aab61bb9588246
MD5 ff15145a2a23b47ad0cdba645baf98f4
SHA1 f669dca971c0643dfcb375ef5503cd5af8aef60e
SHA512 d56f94f3c15002ac7b44777f880861c38fa430dc23768037694889da3b2b29e075c9f9d833a1fae0b4513cc5db9985305a039d218769ac8d739bd89b56f4a4f4
SSDEEP 192:kzTT5fI4sQ6pq+qlvtl8GCJOCOJciAITwA1Fm5BmQCoNIWlJdxqHXYrD0V:sulhRGOiBthWlJj+
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
3296	240603012606408.exe
1524	240603012615627.exe
2452	240603012625892.exe
4452	240603012635408.exe
4744	240603012644986.exe
2480	240603012702033.exe
3232	240603012713580.exe
2200	240603012732955.exe
3312	240603012748111.exe
2956	240603012804346.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2300	756	SecuriteInfo.com.Win32.Dh-A.15732.18153.exe	90
PID 756 wrote to memory of 2300	756	SecuriteInfo.com.Win32.Dh-A.15732.18153.exe	90
PID 2300 wrote to memory of 3296	2300	cmd.exe	91
PID 2300 wrote to memory of 3296	2300	cmd.exe	91
PID 3296 wrote to memory of 3748	3296	240603012606408.exe	92
PID 3296 wrote to memory of 3748	3296	240603012606408.exe	92
PID 3748 wrote to memory of 1524	3748	cmd.exe	93
PID 3748 wrote to memory of 1524	3748	cmd.exe	93
PID 1524 wrote to memory of 2688	1524	240603012615627.exe	94
PID 1524 wrote to memory of 2688	1524	240603012615627.exe	94
PID 2688 wrote to memory of 2452	2688	cmd.exe	95
PID 2688 wrote to memory of 2452	2688	cmd.exe	95
PID 2452 wrote to memory of 2144	2452	240603012625892.exe	97
PID 2452 wrote to memory of 2144	2452	240603012625892.exe	97
PID 2144 wrote to memory of 4452	2144	cmd.exe	98
PID 2144 wrote to memory of 4452	2144	cmd.exe	98
PID 4452 wrote to memory of 3956	4452	240603012635408.exe	99
PID 4452 wrote to memory of 3956	4452	240603012635408.exe	99
PID 3956 wrote to memory of 4744	3956	cmd.exe	100
PID 3956 wrote to memory of 4744	3956	cmd.exe	100
PID 4744 wrote to memory of 400	4744	240603012644986.exe	101
PID 4744 wrote to memory of 400	4744	240603012644986.exe	101
PID 400 wrote to memory of 2480	400	cmd.exe	102
PID 400 wrote to memory of 2480	400	cmd.exe	102
PID 2480 wrote to memory of 4160	2480	240603012702033.exe	103
PID 2480 wrote to memory of 4160	2480	240603012702033.exe	103
PID 4160 wrote to memory of 3232	4160	cmd.exe	104
PID 4160 wrote to memory of 3232	4160	cmd.exe	104
PID 3232 wrote to memory of 384	3232	240603012713580.exe	105
PID 3232 wrote to memory of 384	3232	240603012713580.exe	105
PID 384 wrote to memory of 2200	384	cmd.exe	106
PID 384 wrote to memory of 2200	384	cmd.exe	106
PID 2200 wrote to memory of 5020	2200	240603012732955.exe	107
PID 2200 wrote to memory of 5020	2200	240603012732955.exe	107
PID 5020 wrote to memory of 3312	5020	cmd.exe	108
PID 5020 wrote to memory of 3312	5020	cmd.exe	108
PID 3312 wrote to memory of 696	3312	240603012748111.exe	109
PID 3312 wrote to memory of 696	3312	240603012748111.exe	109
PID 696 wrote to memory of 2956	696	cmd.exe	110
PID 696 wrote to memory of 2956	696	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Dh-A.15732.18153.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Dh-A.15732.18153.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012606408.exe 000001
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Users\Admin\AppData\Local\Temp\240603012606408.exe
    C:\Users\Admin\AppData\Local\Temp\240603012606408.exe 000001
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012615627.exe 000002
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\240603012615627.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012615627.exe 000002
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1524
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012625892.exe 000003
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\240603012625892.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012625892.exe 000003
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012635408.exe 000004
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\240603012635408.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012635408.exe 000004
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012644986.exe 000005
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\240603012644986.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012644986.exe 000005
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012702033.exe 000006
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\240603012702033.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012702033.exe 000006
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012713580.exe 000007
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\240603012713580.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012713580.exe 000007
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012732955.exe 000008
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\240603012732955.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012732955.exe 000008
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012748111.exe 000009
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\240603012748111.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012748111.exe 000009
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012804346.exe 00000a
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\240603012804346.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012804346.exe 00000a
        21⤵
        Executes dropped EXE
        
        PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

240603012606408.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012606408.exe
Size 13KB
SHA256 5c3a9d44d82e1ab2e81c51286b81a777bf2749f194d8024bcd4cf75e1ea47d01
MD5 1f9b630731d0891d39efa4318e7ed851
SHA1 55c0dc6faefd1e3c0c1e3fbf26f76b694a894903
SHA512 44d26e1d81fad5d9a4e29dbf5b62259bb696ed37e8022a2d8d63fa1a277ff12e10af74ef7692df3bdf92115a9e3539b7ab76922802ab0a01bb21cbbe53842d7d
SSDEEP 192:5arT57voDPsD6H4b3JcRtmv30nmQf3v6hW4FtGK52o52TWlJdxqHOwZ:+JvK08utitWlJj+z
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012615627.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012615627.exe
Size 12KB
SHA256 ab68ba636db688e4e10814ef552e30111584727cec26a0057c8da289c20eb8c3
MD5 2f5c3ef1b9adfee0756ef54b0183b195
SHA1 b53c3da45903171498430b2ba747b50063bdb19d
SHA512 908496007387888aa3463247660414dd2aa9edc6cd3910bb6cfd1d9ef52f2b3fb43597b4083878e1a49ce69b14b5530cbc56f2530d781c45ee29a05dae171caa
SSDEEP 192:0hVA4T53ilGatyj6IkvUc526v8kUAtgSEtgUCHjGGRA1zYWlJdxqHXh:7404EbjzR3WlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012625892.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012625892.exe
Size 13KB
SHA256 515f1db424fa946822f1d857c56374dcc9f8159878140837e0c4b0e98a8731d5
MD5 7ac9f4e0ff7bebbae115c476a3068793
SHA1 9e616efa848d75db89df4d36948813156bcafba0
SHA512 62cfee3ea0b68822677090119b5397d8c79a90adb5ffaa03f3b064dd3d9b7e7abd2b374bb800d6361f66791f6b6eb2a7e1066ce134023c17def478da9baa0f0b
SSDEEP 192:wD7AzT5RkIAM46JCKPdN7EycZ8yZwBcDJokueAFRRmYyL3pWlJdxqHTk:waV9OPjxOaVdWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012635408.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012635408.exe
Size 12KB
SHA256 5594ffdec74838aace9775c956055ec7c035c28d460851673c7904c169a6a4f1
MD5 c4316778a56eb25332d2b4f0a6cb174f
SHA1 f618a04a7af214ffc08f638c2911d24660a227fc
SHA512 68d96e315010a19e40226e20aca787fe86fe92f082c1a703bec791222e2f3f7d2a797923dcb49d1660d2c022f25f53319ed36b40fb275bd35329d7cae7eb01f5
SSDEEP 192:dGST5EyfLuST6XWIPpLRIZTUlmCwyAN9Esg1tGeVeCWlJdxqH2t:v2MLVP6lJA5gy8WlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012644986.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012644986.exe
Size 13KB
SHA256 d6da63c6bedd924afe98162d14461576ad5bb9bf54a1b8dabe3eb8a07e67e005
MD5 1cbd654ea142eda5c1b7bc5cf8808483
SHA1 ba4ef8dbbb78a41bf86386110a5b768d6403860e
SHA512 717d15afc87e2ea19fe22b3e74cb7df38e627aa27310ea4e37a8ad07dc44050d5f8513f955fe3ee04634b8c6eddb1007e56909b0424d89d9159a7200aeec1add
SSDEEP 192:qGRy2CT5E34CMY6AwrCCPdtTypWyEPgZUW/Ob7kjSPQcbEkyBWlJdxqHbrCtpM:DCI4rswjGEFh7kjzhBWlJj+6M
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012702033.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012702033.exe
Size 12KB
SHA256 953c25f2f21bfaf56743adbde1550144b8baee3050a2881a24b0f233f1973608
MD5 56f0926408dafaedc7dfdcba561a8752
SHA1 8dbadc61d1735a22665fd54c28736b45818f18f4
SHA512 4519442ef7d3f9086d69b6547a5dece553f2f22f05669577fb87a843d253d6cb057c8b2ff139ce7ba6eeb44d6bd62ef4288d8acd3b93fc5248ad359b219eb7f9
SSDEEP 192:0G8T5QHShzRST6IkRHqWOuD3RKA8aN//G82sPjpYmGV4BWlJdxqHU9:02Iwq/XgzV4BWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012713580.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012713580.exe
Size 13KB
SHA256 2e5e3e37415741237746a02ebb15929b95f69dfb2d9ad620af370361333bba0a
MD5 8e189c758ffacc9278841c3dd44c2541
SHA1 47e56d85783c587269480b1402ba94850810c972
SHA512 73e7fcbf77275c55d7ec5d4fefa73c911e8f6e198c7af8e07ae7c19ba8e253ff72de27d3deb4e8aa15b0ae289463f86045c09f6aa4618efd7a4c413e2d6d22cf
SSDEEP 192:JarT57voc/sD6H4b3JcRtmv30nmQfTvMUzhr9TVtGX52F52eWlJdxqHTAPZ:uJvhk8uKTScWlJj+K
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012732955.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012732955.exe
Size 13KB
SHA256 4a2f6d5771a95a05e8cb2318680d1da4ec70f01f0cc10ac4e33aa0adf7fa8115
MD5 153c16b1db7ce3b0d138e6b4bfe9d3b6
SHA1 bab5ef7e927314355ec0e55596ea8e67f7057b9a
SHA512 ec068b99bff75bcf75cb7dabde3d58596c0242e00a08df547a99c4eb9d69dbcc5cf57b4bd7e327b8443bdb065be0726c0b5ca413667ebb362d00fd78e17edcfc
SSDEEP 192:O67T5zgeCsC16Am3eQGiwzJqN8/HCogisTKpS5VMJltGQw5P5QWlJdxqHiDH2:N+ebsPmhCbCQjWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012748111.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012748111.exe
Size 13KB
SHA256 44e7aefdb26cdb1e47e911de1cbab29f87b7cf9691c3ce11576fd4ddb6a57147
MD5 1631926aa714bdff5c0c1ac6d3a94ba5
SHA1 7c559fe9e4b687e4e5218402d4434443238e794a
SHA512 c3fd9385a53abf4a065f077aec664f212dc885e3dc60798ed97ecceb6cd183fe7ae5cf19f148f5cadda88930444f3a7bd2db177d00027b37d80f3bc2958950c7
SSDEEP 192:XZarT57vocfsD6H4b3JcRtmv30nmQfTvMUzhbVrTGTWlJdxqHVA/Z:XeJvhE8uCrSTWlJj+Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012804346.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012804346.exe
Size 12KB
SHA256 e0c030277c18cdea6d39d49ad28610e08f51f087dc15bbaaa01d51fadcafa564
MD5 29d26b70b85776c165d5d1cf857f634c
SHA1 1b8ac38a665d18a8c487362fbe6fc537d642ac10
SHA512 b66586705902e0b7f315ab700dd2edc89bda75734f88cee4ec0a863a82026d8d941197fa7487d978922e3fe2a8bab5945d58e6630fea83691c4d870fd4037ac3
SSDEEP 192:a1hrT5tKf5ir6HA/Zba73tq7DEyxF8JHpqxEXLmqRjvVWlJdxqHeAuIF:GJMYfQtqqnWlJj+7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads