88a0fc0e08b8e4693b5ebeb70165a9553fcb08b534fa972f5c2d3ef666da0416

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Dh-A.11049.24520.exe
Size 13KB
Sample240603-mfyahsbb9y
SHA256 88a0fc0e08b8e4693b5ebeb70165a9553fcb08b534fa972f5c2d3ef666da0416
MD5 2c85ff388e21afe8ce0bd6fc3d61a894
SHA1 c00520d19a57e806605e5c029e33bb9fc3b44ed1
SHA512 3bba9567171996c33f117bbec1f025215bf959a7ee7136288720c9c4abbef2dd676ed39e18ba03c43c764aed61c5f2227671eb3126c919789076decfebde08e9
SSDEEP 192:Y6KI16BveoiSxW6Z+QM/4YNtGcGsBGFNJP1jOlmcSTjWpsFiITxTbWlJdxqHXfAv:q/3i+EfAvSkcaWlJj+S
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 13 IoCs

pid	Process
4948	242603102509407.exe
4440	242603102519579.exe
2756	242603102531236.exe
1388	242603102545329.exe
4812	242603102555157.exe
2880	242603102605392.exe
2452	242603102615532.exe
4840	242603102625314.exe
1584	242603102636611.exe
4068	242603102647345.exe
2404	242603102657892.exe
5008	242603102707751.exe
2044	242603102717892.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4612	5048	SecuriteInfo.com.Win32.Dh-A.11049.24520.exe	92
PID 5048 wrote to memory of 4612	5048	SecuriteInfo.com.Win32.Dh-A.11049.24520.exe	92
PID 4612 wrote to memory of 4948	4612	cmd.exe	93
PID 4612 wrote to memory of 4948	4612	cmd.exe	93
PID 4948 wrote to memory of 4268	4948	242603102509407.exe	94
PID 4948 wrote to memory of 4268	4948	242603102509407.exe	94
PID 4268 wrote to memory of 4440	4268	cmd.exe	95
PID 4268 wrote to memory of 4440	4268	cmd.exe	95
PID 4440 wrote to memory of 2476	4440	242603102519579.exe	99
PID 4440 wrote to memory of 2476	4440	242603102519579.exe	99
PID 2476 wrote to memory of 2756	2476	cmd.exe	100
PID 2476 wrote to memory of 2756	2476	cmd.exe	100
PID 2756 wrote to memory of 3368	2756	242603102531236.exe	101
PID 2756 wrote to memory of 3368	2756	242603102531236.exe	101
PID 3368 wrote to memory of 1388	3368	cmd.exe	102
PID 3368 wrote to memory of 1388	3368	cmd.exe	102
PID 1388 wrote to memory of 1920	1388	242603102545329.exe	103
PID 1388 wrote to memory of 1920	1388	242603102545329.exe	103
PID 1920 wrote to memory of 4812	1920	cmd.exe	104
PID 1920 wrote to memory of 4812	1920	cmd.exe	104
PID 4812 wrote to memory of 1456	4812	242603102555157.exe	105
PID 4812 wrote to memory of 1456	4812	242603102555157.exe	105
PID 1456 wrote to memory of 2880	1456	cmd.exe	106
PID 1456 wrote to memory of 2880	1456	cmd.exe	106
PID 2880 wrote to memory of 4692	2880	242603102605392.exe	107
PID 2880 wrote to memory of 4692	2880	242603102605392.exe	107
PID 4692 wrote to memory of 2452	4692	cmd.exe	108
PID 4692 wrote to memory of 2452	4692	cmd.exe	108
PID 2452 wrote to memory of 4416	2452	242603102615532.exe	109
PID 2452 wrote to memory of 4416	2452	242603102615532.exe	109
PID 4416 wrote to memory of 4840	4416	cmd.exe	110
PID 4416 wrote to memory of 4840	4416	cmd.exe	110
PID 4840 wrote to memory of 1164	4840	242603102625314.exe	111
PID 4840 wrote to memory of 1164	4840	242603102625314.exe	111
PID 1164 wrote to memory of 1584	1164	cmd.exe	112
PID 1164 wrote to memory of 1584	1164	cmd.exe	112
PID 1584 wrote to memory of 2912	1584	242603102636611.exe	113
PID 1584 wrote to memory of 2912	1584	242603102636611.exe	113
PID 2912 wrote to memory of 4068	2912	cmd.exe	114
PID 2912 wrote to memory of 4068	2912	cmd.exe	114
PID 4068 wrote to memory of 4352	4068	242603102647345.exe	115
PID 4068 wrote to memory of 4352	4068	242603102647345.exe	115
PID 4352 wrote to memory of 2404	4352	cmd.exe	116
PID 4352 wrote to memory of 2404	4352	cmd.exe	116
PID 2404 wrote to memory of 2852	2404	242603102657892.exe	119
PID 2404 wrote to memory of 2852	2404	242603102657892.exe	119
PID 2852 wrote to memory of 5008	2852	cmd.exe	120
PID 2852 wrote to memory of 5008	2852	cmd.exe	120
PID 5008 wrote to memory of 2972	5008	242603102707751.exe	121
PID 5008 wrote to memory of 2972	5008	242603102707751.exe	121
PID 2972 wrote to memory of 2044	2972	cmd.exe	122
PID 2972 wrote to memory of 2044	2972	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Dh-A.11049.24520.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Dh-A.11049.24520.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603102509407.exe 000001
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Users\Admin\AppData\Local\Temp\242603102509407.exe
    C:\Users\Admin\AppData\Local\Temp\242603102509407.exe 000001
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603102519579.exe 000002
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\242603102519579.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603102519579.exe 000002
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4440
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603102531236.exe 000003
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\242603102531236.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603102531236.exe 000003
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603102545329.exe 000004
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\242603102545329.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603102545329.exe 000004
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603102555157.exe 000005
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\242603102555157.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603102555157.exe 000005
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603102605392.exe 000006
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\242603102605392.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603102605392.exe 000006
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603102615532.exe 000007
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\242603102615532.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603102615532.exe 000007
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603102625314.exe 000008
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\242603102625314.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603102625314.exe 000008
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603102636611.exe 000009
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\242603102636611.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603102636611.exe 000009
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603102647345.exe 00000a
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\242603102647345.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603102647345.exe 00000a
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603102657892.exe 00000b
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\242603102657892.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603102657892.exe 00000b
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603102707751.exe 00000c
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\242603102707751.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603102707751.exe 00000c
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603102717892.exe 00000d
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\242603102717892.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603102717892.exe 00000d
        27⤵
        Executes dropped EXE
        
        PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

242603102509407.exe

Path C:\Users\Admin\AppData\Local\Temp\242603102509407.exe
Size 13KB
SHA256 5d56b349b3a7f85e093713761fb1d96b48df8b42fcfd021253b01012a3052e30
MD5 28971913c1910a07ebd6c944ba4f0a79
SHA1 1c12e352e24f1ab5ec6b6abafdc03d72dc52f5ac
SHA512 18c3236184c928bde81755dfe102e24d583c53ba65a2f51fdb45381a1fa75fb3838ec21f40e2afd6a76b0cb353369a9a2015087afdfb3673de55253ce43ecc6d
SSDEEP 192:yttzI16zzI6iyWv6OyVSAnzmNw3uayRPSrys1y0zffkYK6gGCHDlVDlnWlJdxqHB:OJzViFHlw8RvXHhVhnWlJj+Qw
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603102519579.exe

Path C:\Users\Admin\AppData\Local\Temp\242603102519579.exe
Size 12KB
SHA256 5fa66b8e45145002533a04fa9cef07a6e6bd480f6bd379d8aae5c573e0d020c8
MD5 6d6c733670d41b09b9534872828eeb12
SHA1 242164b3c9cf48e61eb1c67dcd6c1bf5c430e4d2
SHA512 5f670ef2de850397eed4486de99a243eaeaa64f4d06dd801a6ca22c946fe9acb09b848b7f68e3c588c90de0f9dad5522726dfe2b889a8d9f3a4fdf40d7fc0917
SSDEEP 192:QOKI1O1NZiKT0mq6PIU0fH9uaSLfVtZMYPz3lqEU1t7mvAMWlJdxqHbrVHg1xF:+briKwmNVvrMP1wvWlJj+s
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603102531236.exe

Path C:\Users\Admin\AppData\Local\Temp\242603102531236.exe
Size 12KB
SHA256 fbc7fe68d316d8c60e266d595d642107be03ec3e1ee252560a52702eb0a62417
MD5 36627d86a8c8b76d1269dd9cb3e22ae2
SHA1 2a9291e46600409d732a5acd89fb59218fa6deb8
SHA512 81ce1a495c83d4c275243c5697e8974d995778c78498b673123f05a88abceb7c78611f914af7336311a146ddeac87961a081f731b6b264453972f5d2945ee694
SSDEEP 192:Bk8zI1lJYWNzsF6vZCPYods2nDfF0oTPtX1EL4jawlm5pDWlJdxqHgruHI1x:BYKKYc+j4EX4jWlJj+i
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603102545329.exe

Path C:\Users\Admin\AppData\Local\Temp\242603102545329.exe
Size 13KB
SHA256 2ecea1c8bd5384d3fc7e03248d1959c9ca1b5024d92576550c472d15c6217f14
MD5 01cb14a5b7c9cd782b36311ffb708976
SHA1 0eae147b00b4e4b06d1ca9200246bd219588ab9f
SHA512 0235f74447cd3d23e6fcbca45cfc7e8b9c604c931a0002544cebc3c2ef553b00934de5288bb323d170632fe40c87038048c4bd022dc0d053370ac169d64ee366
SSDEEP 192:S6zI16BveO3GiSuW6ZcxQd/TG5KQssHGyyIxPwug25/zOWVINtCi5y59WlJdxqHj:JJRwiBr+gfyyIqOSscEhWlJj+J
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603102555157.exe

Path C:\Users\Admin\AppData\Local\Temp\242603102555157.exe
Size 12KB
SHA256 8f103a5157315255c0031761eedea91fe4ec09b789aa734eb5aea13aea1b4b1b
MD5 374fab40e82fd36696ed60cca636518b
SHA1 46d53426d9e515ad39400c6bf5617f8003a82b01
SHA512 f344041d5b38040bf1d4adcad22c72e05dc3a5d99499d93324d3557dc2dbc709aee772fde0303003a6b81385700c7829cbe4923a9855e879bfd77218658a01aa
SSDEEP 192:0WoI1Pfao5l++bd6e8ZHHg6ZqD5rTWOjgPLkmKRc5/9kQQGrJDSDsWlJdxqH5Hov:w4yo5l+8TJjb9QxdDSDsWlJj+Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603102605392.exe

Path C:\Users\Admin\AppData\Local\Temp\242603102605392.exe
Size 13KB
SHA256 8c58f034088a5adb9e16fdc48a026ece748b9fe79d19ab0eeffce43c38096f73
MD5 2e886a6e89b65fe5c9a54c2a287c5cac
SHA1 c8a8911bc28b9c0d5b5404a4b8c6873aa73e3f1d
SHA512 9efe70ea8b7999bc043fd5864cc45acd9ba6688e7ed91562aab07b0e920cc04f1102b5fb2ef2beea4ea5e92c9624431e6b11f5363889304d47972fdc0c66fd57
SSDEEP 192:0iphI1nYWsChYWmB6ZaMQoG5fsMl1G7NiLPRmObq7MWr47HlbyA5V5OWlJdxqHiY:1hjChXm/Md7Nq+ycrWlJj+h
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603102615532.exe

Path C:\Users\Admin\AppData\Local\Temp\242603102615532.exe
Size 13KB
SHA256 4b245b29524d4875378068988cc386b4c0c642b3d59b5eaf1c2b4b9b04b98e17
MD5 1e86c715d1a03287103b2e7044ec1c26
SHA1 21f39209ed33ab1d85769fc8fa4035f2b3901cbf
SHA512 ff8b84886365163164f521914b978870a5b56d8d330202a9ee4935553564664f5d507484e80b4f7192ff52f93ad4d49decbce7e38faa422b868ce3159d5aa0d6
SSDEEP 192:WBf3I1tAFBnen6a7cfSZW+K5ZHetEzNjJJPct+KIrSWS/Y9xyLDlMDlkWlJdxqHz:W9RFBeg6anRoLhMhkWlJj+5
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603102625314.exe

Path C:\Users\Admin\AppData\Local\Temp\242603102625314.exe
Size 13KB
SHA256 86c6cf57531de7f0457eb796ff8c952abac778b977b824eb0a92c0aeaa82cce6
MD5 76b8d7760c36000920104a3c8e1772f8
SHA1 1b139e1b2abbd85985a18e5eddb575b4588fd7cd
SHA512 4f82938ec227da72a156b0b339e692f2450ff04ce1abaf5bcdb502c57e826be01db1157782c03e91d7e646f6adf446051fb3eef9a584f84d19aae04a9f259334
SSDEEP 192:SRyXI1pugqRBe6/M+QaxB33s24DuGmpYcPavNvwqJR0ierVyoM1WlJdxqHXh1x:XuqjgIFc2e3NCXcNWlJj+j
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603102636611.exe

Path C:\Users\Admin\AppData\Local\Temp\242603102636611.exe
Size 13KB
SHA256 fda0b72b6f228fb42f17c7b95168f2ddbcb5151148ac296a2ae05c3465ffd8ab
MD5 20a3ad20a50d4466ede9d9c580b4f026
SHA1 1b6165e369aba856ac6d24cdbde9465e21b175ec
SHA512 b9c8d8a671b440df60b81005d974693a0721810b937c730a3c0f26f564b127556ce821a31a27a436075ae305907817998d4221ce69c5ca76c7c0879a5e9291c0
SSDEEP 192:H7A7I1v3QPRs+6/QrZK5Z1Ho47WOGY8PmtY9cxSHrm6s+yT2zWlJdxqHXYrYV+1B:mAQPCKrCKXYRzfOWlJj+wB
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603102647345.exe

Path C:\Users\Admin\AppData\Local\Temp\242603102647345.exe
Size 13KB
SHA256 2b9b65239d12fa41db9a193d43ff43a9e945a5594667d3de8fb68182ae03bcf7
MD5 1774744a244e9b63d5340f3f5b8c3f8a
SHA1 7b8b968b88910a08a042ee2dcd2faba0ff216b6b
SHA512 c91f15acfab2275cbd1ed8b2eae886de214b8649e65d1b2a2b52765ead263c3b30f9087373fa4fd020403a98b586b4dc545052c426ce37b3b7d639aae70adf98
SSDEEP 192:GCDI14gUgTOO6rmS5NH5KaoKM/qi0Pl+Hj+FDptdmDiEWlJdxqHiYrPf1x:1+Ugau5DUtwDiEWlJj+1
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603102657892.exe

Path C:\Users\Admin\AppData\Local\Temp\242603102657892.exe
Size 12KB
SHA256 a9e8c8b7dec6fc43f87ae0a9272b014f4f2e92a8d4e0901bf13dc94a6e5748ae
MD5 4e6e032e20e20c2925fccb0b9c9e8c3d
SHA1 45deb274fb9f12956e02b19f9b6a6b89de242302
SHA512 f3fd777dce4c81d85834053e93acdf7d6be4f98fd6630b2d4a96e9959298d2dde5f30a75baa44c634ae063968806287c67c9d01d023b1dd3147ce66c78579651
SSDEEP 192:0+jDI1/4u7NQATAd6BCHntEsrTH7TbPLvtEBYnoJdrpgj/nWlJdxqHbrnQ1x:3NuZQlTsJngbWlJj+a
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603102707751.exe

Path C:\Users\Admin\AppData\Local\Temp\242603102707751.exe
Size 12KB
SHA256 e75fdd5086242c1a60701f71ede9f672678ba738dfbc097518b762fa67df7765
MD5 bf94504a0c52a3fccce2a21c88a265a0
SHA1 b90d0eb2e58b37725767ec57ff717ec828763afb
SHA512 2037dcc2d14796c5d7d7bc555330c8f5a7804c8a0212bb50734326e8d148d3ae1700315dae7636e4d7e3db41bb8c5e3f5af5c081212b529d1df13a2c6a1e6a21
SSDEEP 192:JV0I16j1TAa+HA96on8mBi7kRy3XO2ScLbwxPFhTsbFu74+QYGV5nWlJdxqHiYr3:QAan8D3Jbvxus+Q5/nWlJj+tJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603102717892.exe

Path C:\Users\Admin\AppData\Local\Temp\242603102717892.exe
Size 12KB
SHA256 1663b2cf8712f0783f7189b9cea87f142b7d4e844d8cf96944c8a71e3fb7bb0b
MD5 73410746499a76885eb21716ab180d27
SHA1 ef1490ed555d8eafe07d64c0393de14963ac3ddf
SHA512 fd229928d7f793a68fd7ed24321f7efadffd7b5f4c722046799649cae95f2bab144b021a8b4ec323fd9c58d83ba2a2f43a651256f736ac8d87c3632105e9fc72
SSDEEP 192:faDI16YGITUN6BORFKvftUs8bf3PfLPlLBSs339LGRgsWlJdxqHXbJ1xSx:AsGIwXsKfRAJWlJj+f
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads