Analysis

  • max time kernel
    122s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2024, 03:49 UTC

General

  • Target

    cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996.exe

  • Size

    97KB

  • MD5

    76a669618d75f23e7b039f6cb40e227e

  • SHA1

    da3bc8af8a5b0ffb420c922c4e0bcc5779924a64

  • SHA256

    cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996

  • SHA512

    7263a4363917807004177f9dc8b810aef64127b122d6b18d0840460f367697c6cc68535a6205643846be09768304362662d22ee7ba066ef7dc08b24ba3603128

  • SSDEEP

    1536:iF0AJzLopHG9aa+9qX3apJoAKWYr0vcioyjp2RXKTzRZICrWaGZh7N:iiApLN9aa+9U2EWyipjp2R6JJrWNZX

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996.exe
    "C:\Users\Admin\AppData\Local\Temp\cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\ProgramData\Update\WwanSvc.exe
      "C:\ProgramData\Update\WwanSvc.exe" /run
      2⤵
      • Executes dropped EXE
      PID:2736

Network

    No results found
  • 158.69.115.115:443
    WwanSvc.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\Update\WwanSvc.exe

    Filesize

    97KB

    MD5

    fde11fd8a944b62c947a37460efbab71

    SHA1

    a3bcd805d7a4714f258ecd8caeabefce0b473ac2

    SHA256

    d4e2ab5427a28263a785cc716dc18a5fbd311e9b52a3fa40290c0a6c9feac2fb

    SHA512

    b215de06edc0cb68d8ea8aebda23218d0c7a955e3d6a795af763cc0efd1e6d2253f40e869f396a15dafb919683974ab8a225a3431cb2d4bd774b65a5a0766732

  • memory/2456-1-0x00000000002E0000-0x00000000002FE000-memory.dmp

    Filesize

    120KB

  • memory/2456-6-0x0000000000090000-0x00000000000AE000-memory.dmp

    Filesize

    120KB

  • memory/2456-8-0x0000000000090000-0x00000000000AE000-memory.dmp

    Filesize

    120KB

  • memory/2456-10-0x00000000002E0000-0x00000000002FE000-memory.dmp

    Filesize

    120KB

  • memory/2736-7-0x0000000000A50000-0x0000000000A6E000-memory.dmp

    Filesize

    120KB

  • memory/2736-9-0x0000000000A50000-0x0000000000A6E000-memory.dmp

    Filesize

    120KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.