Analysis
-
max time kernel
142s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 12:41
Static task
static1
Behavioral task
behavioral1
Sample
8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe
Resource
win10v2004-20240508-en
General
-
Target
8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe
-
Size
14.9MB
-
MD5
2e58d70bb2ba90b46df2bcbc4e6a08ba
-
SHA1
0c59dd1c80e0993d73645f5e3e09c3554f7faf1f
-
SHA256
8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac
-
SHA512
c556bf08a2530bc9feaf6e9074cada739a18a27f7c7a75f89945d68ddbc7b1cdbfbd8e69098b7cdcde76047119e3586cce65f345beb8de08992d7680ef715c1d
-
SSDEEP
196608:VzwoVmUuCvh7pQoXhQET1AIx53YJbaogxWVmVxH5/AuS:xVmUuy7p7XhN5VIHgkVmbH5/AuS
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
pid Process 1732 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe 1732 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe 3048 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe 3048 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\font_temp.ttf 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe File opened for modification C:\Windows\Fonts\font_temp.ttf 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2736 PING.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1732 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe 1732 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe 3048 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe 3048 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2656 1732 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe 28 PID 1732 wrote to memory of 2656 1732 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe 28 PID 1732 wrote to memory of 2656 1732 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe 28 PID 1732 wrote to memory of 2656 1732 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe 28 PID 2656 wrote to memory of 2736 2656 cmd.exe 30 PID 2656 wrote to memory of 2736 2656 cmd.exe 30 PID 2656 wrote to memory of 2736 2656 cmd.exe 30 PID 2656 wrote to memory of 2736 2656 cmd.exe 30 PID 2656 wrote to memory of 3048 2656 cmd.exe 31 PID 2656 wrote to memory of 3048 2656 cmd.exe 31 PID 2656 wrote to memory of 3048 2656 cmd.exe 31 PID 2656 wrote to memory of 3048 2656 cmd.exe 31 PID 2656 wrote to memory of 3048 2656 cmd.exe 31 PID 2656 wrote to memory of 3048 2656 cmd.exe 31 PID 2656 wrote to memory of 3048 2656 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe"C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Restart.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe"C:\Users\Admin\AppData\Local\Temp\8B0634~1.EXE"3⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3048
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113B
MD5978d3afcd430e12574940784a306a930
SHA1476b59fa345bf72049c53e7b9c0766d6cd6e30c0
SHA256ca9869f8c04e523c71b628ca941151ef51428985506fd47130dddf859fde2220
SHA512970212ea574c05a7db2e622a3d5a1929dd7d2006d7e1fc780c9428372b2b9b58f851f4082bf3a9d0727bb72b92abcdb9aded071dd42ad2aecb2fd15fb7d59512
-
Filesize
8.0MB
MD5092a99ee52bbaef7481cc96c5b85b992
SHA106b8475f99605af9ff9ff3ed1d0eb907fd57c06b
SHA256b3f675ccfc65edd6f27432dec6639b1414e9dc627831791263a99e2d711d215d
SHA5123538cebe1c0e2439c7ba289c4420627d59b4922e26242408f114aa01d342734b057d92edac35bee7c47cb926091695efc6c560802db0cd342f75cee1f8b96baf
-
Filesize
1.6MB
MD5a081782e61d769dcd299bb7672aed743
SHA178d4795bb43ad2b949192b09987b17eba156dced
SHA25634ece32d4bf3dab02772326afd2e5d8d1f28d7c5be6379c3d40875a03345bafa
SHA512e7384eab27e866284071709f90097db8a6bc630d5dee8b102a0f4a6b9af9a70797209bd50d00ed28899ee4628b937f44cf2eb8d5518562b3c37925ad53704ab0
-
Filesize
333KB
MD556a2bcecbd3cddd6f4a35361bf4920d6
SHA1992e63be423f0e61093ba183f49fc0cbec790488
SHA2565fcfac18758a12e0e717a5189f379922a32b5ac12f26491e638d70b54ae1dcab
SHA512473cbdf760242db1f0f1d0c27046c0564998f2bf931ad03feb28af3c7bd253d00e6f0836dadf37f29e0db4171eb64e6a15ed4cb9a9d28b48fb0aab601573f551