a00e9b55e488312f3d8a7b5408dabafa5c2118ac2ddec6ac2c5648c78f9a8ec6

Analysis

max time kernel
140s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Dh-A.6960.15231.exe
Size 13KB
Sample240603-bthw7sec4w
SHA256 a00e9b55e488312f3d8a7b5408dabafa5c2118ac2ddec6ac2c5648c78f9a8ec6
MD5 a85d635866bfed89c97a8d890e53356c
SHA1 faec4440942449db7fccb652b1e4e0826ede805d
SHA512 ae52ce200a24092ef840f0150c43f49ffaaee72d3906df39ffc73e13ac26f514bdbad05c988e3148d61378249c2f79498255f474da63593219e850795a7c9519
SSDEEP 192:J1hDT5tLfRir6HA/Zba73tq7IVer9e25JeVdmCRmCGWlJdxqHbrj3:PhvwoiCQWlJj+T
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
4412	240603012606304.exe
5004	240603012615789.exe
2640	240603012628023.exe
1404	240603012643554.exe
2584	240603012655039.exe
1812	240603012709179.exe
4984	240603012721476.exe
3760	240603012734695.exe
4476	240603012747695.exe
1312	240603012804257.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1592	2272	SecuriteInfo.com.Win32.Dh-A.6960.15231.exe	90
PID 2272 wrote to memory of 1592	2272	SecuriteInfo.com.Win32.Dh-A.6960.15231.exe	90
PID 1592 wrote to memory of 4412	1592	cmd.exe	91
PID 1592 wrote to memory of 4412	1592	cmd.exe	91
PID 4412 wrote to memory of 3320	4412	240603012606304.exe	94
PID 4412 wrote to memory of 3320	4412	240603012606304.exe	94
PID 3320 wrote to memory of 5004	3320	cmd.exe	95
PID 3320 wrote to memory of 5004	3320	cmd.exe	95
PID 5004 wrote to memory of 2380	5004	240603012615789.exe	97
PID 5004 wrote to memory of 2380	5004	240603012615789.exe	97
PID 2380 wrote to memory of 2640	2380	cmd.exe	98
PID 2380 wrote to memory of 2640	2380	cmd.exe	98
PID 2640 wrote to memory of 3924	2640	240603012628023.exe	99
PID 2640 wrote to memory of 3924	2640	240603012628023.exe	99
PID 3924 wrote to memory of 1404	3924	cmd.exe	100
PID 3924 wrote to memory of 1404	3924	cmd.exe	100
PID 1404 wrote to memory of 2912	1404	240603012643554.exe	101
PID 1404 wrote to memory of 2912	1404	240603012643554.exe	101
PID 2912 wrote to memory of 2584	2912	cmd.exe	102
PID 2912 wrote to memory of 2584	2912	cmd.exe	102
PID 2584 wrote to memory of 3464	2584	240603012655039.exe	103
PID 2584 wrote to memory of 3464	2584	240603012655039.exe	103
PID 3464 wrote to memory of 1812	3464	cmd.exe	104
PID 3464 wrote to memory of 1812	3464	cmd.exe	104
PID 1812 wrote to memory of 1948	1812	240603012709179.exe	105
PID 1812 wrote to memory of 1948	1812	240603012709179.exe	105
PID 1948 wrote to memory of 4984	1948	cmd.exe	106
PID 1948 wrote to memory of 4984	1948	cmd.exe	106
PID 4984 wrote to memory of 2044	4984	240603012721476.exe	107
PID 4984 wrote to memory of 2044	4984	240603012721476.exe	107
PID 2044 wrote to memory of 3760	2044	cmd.exe	108
PID 2044 wrote to memory of 3760	2044	cmd.exe	108
PID 3760 wrote to memory of 1432	3760	240603012734695.exe	109
PID 3760 wrote to memory of 1432	3760	240603012734695.exe	109
PID 1432 wrote to memory of 4476	1432	cmd.exe	110
PID 1432 wrote to memory of 4476	1432	cmd.exe	110
PID 4476 wrote to memory of 2460	4476	240603012747695.exe	111
PID 4476 wrote to memory of 2460	4476	240603012747695.exe	111
PID 2460 wrote to memory of 1312	2460	cmd.exe	112
PID 2460 wrote to memory of 1312	2460	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Dh-A.6960.15231.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Dh-A.6960.15231.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012606304.exe 000001
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Users\Admin\AppData\Local\Temp\240603012606304.exe
    C:\Users\Admin\AppData\Local\Temp\240603012606304.exe 000001
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012615789.exe 000002
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\240603012615789.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012615789.exe 000002
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5004
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012628023.exe 000003
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\240603012628023.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012628023.exe 000003
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012643554.exe 000004
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\240603012643554.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012643554.exe 000004
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012655039.exe 000005
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\240603012655039.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012655039.exe 000005
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012709179.exe 000006
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\240603012709179.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012709179.exe 000006
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012721476.exe 000007
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\240603012721476.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012721476.exe 000007
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012734695.exe 000008
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\240603012734695.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012734695.exe 000008
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012747695.exe 000009
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\240603012747695.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012747695.exe 000009
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603012804257.exe 00000a
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\240603012804257.exe
        
        C:\Users\Admin\AppData\Local\Temp\240603012804257.exe 00000a
        21⤵
        Executes dropped EXE
        
        PID:1312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

240603012606304.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012606304.exe
Size 12KB
SHA256 439fa7fdef9458856bfba6347762caf098f8f0690773dcef54abc10319b30823
MD5 e70f67d82ee9eff25452f4aefaa2107a
SHA1 e73b6d8b0c9df1bc74ee9356a7a18c32b577b913
SHA512 e50508c0e870c20ec1c4cbbc0dc39ea0b64d71374a99521dbd58bdd2a21b92d857c8ad37e54e2d951b122387213c2b338d8808e3df83785d7a2b7c63cb0caa1f
SSDEEP 192:p4z2T5poqPT8y6yCgo30j+goKwNVLK/7NyhwfOBCxVcWlJdxqHeQ:N0C4QvozVuS/oxVcWlJj+N
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012615789.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012615789.exe
Size 12KB
SHA256 3867528d2c85d4823d9f67951bb885e66474158e79773a7449f823be0ea51fb2
MD5 1b648c9884535d39c2f2a16959672516
SHA1 c2fb6ea70525505f244aa6395436295f3983e86f
SHA512 04a87c4cc4c5c3787cfa7f9809cf518d976bc37684624a4b19b1b9e06c7f8739f4faf877ae752e82ff50b709ff36c674127ed14e7f567f5c25128d7e3330c86d
SSDEEP 192:AdMT5a4VSlv9ib6oEwCc+0U6osy7AihpviFrZYWmtWlJdxqHiYrs:xBKMrlj0ljtWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012628023.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012628023.exe
Size 13KB
SHA256 fef9b3a187012084ae19c55085c7ad85b37aa83ce28ed95b33d94e4ffb7a281f
MD5 f39d26710babab64db82197dcf544552
SHA1 dff859730b7b6896a109be63853631f90541589b
SHA512 1358fb2cebccd4878274b77058c55abead99ba35fca85077dd6b4f79cd6248bc58246e202ad338d18fff50ccee8de8f3be7abe1c24853992065dff94a2ce2a19
SSDEEP 192:hP4T5pvf7pMhMA6bgqECCDCJpCI8xSBD9NnV+UsZ4l4FPC7WlJdxqHH:Kr7pMK2/IPALFq7WlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012643554.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012643554.exe
Size 12KB
SHA256 9f631be459b41e3bd88306287b9806ede9b62335ba1d1a25752b079ffdebca8c
MD5 9120f5a3956571cdd87c7e46c3ae1e43
SHA1 443025e2c2481a06681dda1d02bd7c5ff2b59c3f
SHA512 faa9afc7c3ea294d240252674d32d54e06b5ea6acb6b7a5099e4c79982004a692aa18fc28153a3d8cdca90753585f3ccf4ecb4cbb7a4ccc17dfae359562e2696
SSDEEP 192:cz+PjT560Cbn8i638romFMzlXAepCKSVkDgA4vSAXWemwWlJdxqHyQ:nl+8qzcRCKZg2rwWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012655039.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012655039.exe
Size 13KB
SHA256 50ab6a4f402369d099ee0bfcf8e217988daae7e43fe94cb1278fcf7514a2e5bc
MD5 1ad927a543fadf5fb618943efae0d656
SHA1 20ea07e82da1e4a56d7c3960a1522b90884e612c
SHA512 9afe206aacc7a27ea596e4082013d731eb386a940fac5637334a19ca6b2e836cef9ab538fb0bb2952e98d33169f788bceaf3913232738c1062ff9848963b5bd3
SSDEEP 192:r3KaT5RJiBdMA6Dmcwd8CyVmfCWRxDt56NUI+DiuWlJdxqHkPP:pE4+o9MT+uWlJj+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012709179.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012709179.exe
Size 13KB
SHA256 be5ffa64e68c9d4e7bd24888a4009413f33bbd3e55d3e97715e0588e61b30861
MD5 7101ad534d28155ff2fc0c4c914322e4
SHA1 dd79916303904799444e73a429505eb41bb4ac02
SHA512 d96c68fad3a18b973951f1cb9592ecd162e1e84c20e342e415f83e9098d5c67a7903862703b9346b9d0cfc18c77d37444e9e9021326a64029151550a562d6ba5
SSDEEP 192:5SfCT5WNkCuhM46TmvcAya7BmHy2hvOryZUtFujy2WlJdxqHXy:AqMu6sR6O2WlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012721476.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012721476.exe
Size 12KB
SHA256 a9d270810c569fe94b42db32b7e41ba66d23e6758cd2128baf8bf199e1b74dd5
MD5 4b05131cf0efc2c104928325a92d5856
SHA1 a4f4ab32cb54097981cf4268e98b16953fe1f4be
SHA512 a1ce39b485ac26bc4e96a3a518198a683e0a4630564e657da0c73f058815a1a08e7ee17bac6796c1b002189169a73fbd7487dcfd845bb7059ad2141aaba107ff
SSDEEP 192:s9LT5zUoWli76uYEGszJ9cBfsspoCOw3umyl12fWlJdxqHum:uioWUmTbHWlJj+f
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012734695.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012734695.exe
Size 13KB
SHA256 30f614ce1cac2f05a9cc7fa2d5e9d5150137dddc10e9d40e99d0875080049c3a
MD5 5650f2b9023bcf1f4c90541c09f3c1c3
SHA1 470f304d95ad393f38fb3c329be8af3b4011ab16
SHA512 0ca96b15753c37835c7981bb56719e0dad68de97f4462cbd1ea9c8e1ec7b9c978afb8c4f7e1b0d5135771850b008bfdb7538c49ccc2219ff492eaa5d9b1cffe6
SSDEEP 192:CnOjT5UhyhUso6pRyv9gO4SpG7uvKh7oYdV1LMy45WlJdxqHXYrXf7:5jfhRU4vuqp+WlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012747695.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012747695.exe
Size 13KB
SHA256 0c8d713dad5ce75800f7aff17637b3499cfe632dafbba67e41de87c0acdbb37d
MD5 a2d4a6ac894bcff9db262985cfebe2c2
SHA1 08a3047453e8944f36231860d494bfd1058230f1
SHA512 4cd83e430f58fef6150fc1896ba12fd51dd9095b5d437e4478c6b25eccb89a70cd6d66380dc4077ec12f8a2aa98efb626f1bd6d378ed325fa068f746de5b7802
SSDEEP 192:ettH4T5sihMOx6Nm6i/IuWKUjVE8tTezeWGnY26wMrX/4CzEWlJdxqHXYrTI:W94Fh/p63j5GX/1zEWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

240603012804257.exe

Path C:\Users\Admin\AppData\Local\Temp\240603012804257.exe
Size 13KB
SHA256 395a31c2e63fa575ba8a16b3e6421a5786e707d185d52a52b78f1bd46b2f57da
MD5 96767681fbbe3f99a94c1f12bc4debeb
SHA1 6b9b21850b769d9803e33e17803e04d98253d476
SHA512 58c342d7b63471aa47bba47179a2a9fd2fa672b0e0130974b870b44345bd1582332d2178e369dfb323d2398fdcc2a7f8cb7ecdad08f5ec3dc4677d46015b881f
SSDEEP 192:YHy7T5tuC9vML6yAbvnZ85NmnlaSUd7UYQpbmTmjp5l5+WlJdxqHgrvt:+ArB90MzoyjSWlJj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads