Analysis
-
max time kernel
92s -
max time network
100s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-06-2024 22:05
Behavioral task
behavioral1
Sample
SOSA.exe
Resource
win11-20240426-en
Behavioral task
behavioral2
Sample
SOSA.pyc
Resource
win11-20240508-en
General
-
Target
SOSA.exe
-
Size
6.4MB
-
MD5
4ecd7183076c4d8229664cee5199dde1
-
SHA1
a5902727332c61356128a6f6492798e26535fd82
-
SHA256
203b1ecdbcd0747b3c8e3fdd19a92e49a7e35054ae85b615b12eb8cb7248bed0
-
SHA512
5895136dcc5439b2c8de03d0f80cdf9f1c1236eb1dcead39179d16d706dbae45ae5dcff442e1f4cab6d4005eeba7e1b1699c81184f55a3414ec858cf312cf92c
-
SSDEEP
196608:3d9YF1S+DfyGz21X5Sp6GemDMPwuWA9Plae:HYvDfD6pfaMPfzae
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
Processes:
SOSA.exepid process 456 SOSA.exe 456 SOSA.exe 456 SOSA.exe 456 SOSA.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
SOSA.exeSOSA.exedescription pid process target process PID 3080 wrote to memory of 456 3080 SOSA.exe SOSA.exe PID 3080 wrote to memory of 456 3080 SOSA.exe SOSA.exe PID 456 wrote to memory of 3188 456 SOSA.exe cmd.exe PID 456 wrote to memory of 3188 456 SOSA.exe cmd.exe PID 456 wrote to memory of 3176 456 SOSA.exe cmd.exe PID 456 wrote to memory of 3176 456 SOSA.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOSA.exe"C:\Users\Admin\AppData\Local\Temp\SOSA.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\SOSA.exe"C:\Users\Admin\AppData\Local\Temp\SOSA.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls & title SOSA CARD GEN BY lcm_20803⤵PID:3188
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3176
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
82KB
MD5a62207fc33140de460444e191ae19b74
SHA19327d3d4f9d56f1846781bcb0a05719dea462d74
SHA256ebcac51449f323ae3ae961a33843029c34b6a82138ccd9214cf99f98dd2148c2
SHA51290f9db9ee225958cb3e872b79f2c70cb1fd2248ebaa8f3282afff9250285852156bf668f5cfec49a4591b416ce7ebaaac62d2d887152f5356512f2347e3762b7
-
Filesize
120KB
MD59b344f8d7ce5b57e397a475847cc5f66
SHA1aff1ccc2608da022ecc8d0aba65d304fe74cdf71
SHA256b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf
SHA5122b0d9e1b550bf108fa842324ab26555f2a224aefff517fdb16df85693e05adaf0d77ebe49382848f1ec68dc9b5ae75027a62c33721e42a1566274d1a2b1baa41
-
Filesize
192KB
MD58a2ee9274d90698478e4f2f56d8b532e
SHA11a8f9adcd1cb707e247fb06c30e3e79317088f67
SHA2566d940fa068c93f295c3ac63ad6cc54a500db5f24b3c0840dbfb383b92519c35a
SHA512a85241481a67fe295f6b6a1b9b5a59a7b2a18b75050068fcd16ba048564d5aa774896953241b574084e477dc198fbefdc8c6004d120d95085b88aca42b38ce9b
-
Filesize
63KB
MD5787b82d4466f393366657b8f1bc5f1a9
SHA1658639cddda55ac3bfc452db4ec9cf88851e606b
SHA256241322647ba9f94bdc3ae387413ffb57ae14c8cf88bd564a31fe193c6ca43e37
SHA512afcf66962958f38eec8b591aa30d380eb0e1b41028836058ff91b4d1472658de9fba3262f5c27ba688bd73da018e938f398e45911cd37584f623073067f575b6
-
Filesize
155KB
MD50c7ea68ca88c07ae6b0a725497067891
SHA1c2b61a3e230b30416bc283d1f3ea25678670eb74
SHA256f74aaf0aa08cf90eb1eb23a474ccb7cb706b1ede7f911daf7ae68480765bdf11
SHA512fd52f20496a12e6b20279646663d880b1354cffea10793506fe4560ed7da53e4efba900ae65c9996fbb3179c83844a9674051385e6e3c26fb2622917351846b9
-
Filesize
77KB
MD526dd19a1f5285712068b9e41808e8fa0
SHA190c9a112dd34d45256b4f2ed38c1cbbc9f24dba5
SHA256eaabf6b78840daeaf96b5bdbf06adf0e4e2994dfeee5c5e27fefd824dbda5220
SHA512173e1eda05d297d7da2193e8566201f05428437adcac80aecefe80f82d46295b15ce10990b5c080325dc59a432a587eef84a15ec688a62b82493ad501a1e4520
-
Filesize
704KB
MD590dd02c9ce097f0b486ee6cb4348a520
SHA16c0438f7ed3f7bde81c8545958219eb3d964110d
SHA256740c9f22a3656455a76e4983010bc5d542b2c13e2a34c2d3470f5bceffed31ce
SHA5123658ce031c123cf0cde3721232a0470d4371e7bf2bed0a1d4881d21e8aed632778f774d45feb6cb7d5c2c3c32747f94bbb80682901356a2e62717f123b6a5d62
-
Filesize
448KB
MD51f548445456ea9e3c43bb690d60eeada
SHA1efb7165f99cc2934ae83a3758b346280d7852949
SHA256a16b8368869b3e5a0d66ce5b2e1a181d3b13ec3fb9305b6247dd5656a78c4f29
SHA512e6d5d419efdd6963f8e7cc33906e1f7eaddc37815419a494a8d601727d78a0f8947de156bf1a330314a825fa6962fa412fbd2d1e8f8918a8635b982086d1d4f5
-
Filesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
Filesize
448KB
MD5582833144e887168774f56a01fdf1457
SHA1ec47e48a6c4be7faada062c3b092c966ee4af962
SHA2563ef32179471862e13d1b5069b4691038f96d6a923b02fba6ee4933c001d568fc
SHA512036fa5db6a719b4bdda259e2e0ca8d1d5a8c55d43df1f69876dcba5e86b78d671573eee702f60748b1a8ba53cbf3d3a7e2b06816b2e508ec72627e86cd087a92
-
Filesize
29KB
MD5756c95d4d9b7820b00a3099faf3f4f51
SHA1893954a45c75fb45fe8048a804990ca33f7c072d
SHA25613e4d9a734a453a3613e11b6a518430099ad7e3d874ea407d1f9625b7f60268a
SHA5120f54f0262cf8d71f00bf5666eb15541c6ecc5246cd298efd3b7dd39cdd29553a8242d204c42cfb28c537c3d61580153200373c34a94769f102b3baa288f6c398
-
Filesize
512KB
MD550c7d2568ee2a46fd2f53d12437225d8
SHA176de26495be7d4bda80dfea97e22adb6fc715ad1
SHA2569bb7b54602322c15eb62c38af3c4abcce3b51789cd5b6cce82260b857e0fad28
SHA512b3068468ad9f8472e38c24da47b8b00da54dec0be854b42c72940ba23b3d5f8a03222a4bb5896fa75306a453cee8e8d61d14f304f63d25a50df03d359cfd6b19