Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 23:54
Static task
static1
Behavioral task
behavioral1
Sample
57b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b.exe
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral2
Sample
57b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
57b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b.exe
-
Size
274KB
-
MD5
0ae678ad8ad46e391cb05fee3062a863
-
SHA1
380d364a1bee328d54ab9e96ce7b3526ac5e7527
-
SHA256
57b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b
-
SHA512
3f21d6d70c195081a5d36ed147cbbc25d07300572eb5f9d5c9a39a24fdf03000065d460e2f4c984832b1939c2e852eb4209db11ae361a831d45a38dc6af68de5
-
SSDEEP
6144:snqAzz+97V+OTvyp0O6jNybFzmNL+4jz7IbJus1XS:sBz6l8OTvW3qy5zC+uIdv1
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1912 t2gf4afrlddqvqigvpxg.exe 2336 lcpnhqges.exe 2732 dqgqjrd.exe 2804 lcpnhqges.exe -
Loads dropped DLL 5 IoCs
pid Process 3020 57b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b.exe 3020 57b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b.exe 2336 lcpnhqges.exe 2336 lcpnhqges.exe 1912 t2gf4afrlddqvqigvpxg.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\meoetcaht\sllwubhmw8c5 57b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b.exe File created C:\Windows\meoetcaht\sllwubhmw8c5 t2gf4afrlddqvqigvpxg.exe File created C:\Windows\meoetcaht\sllwubhmw8c5 lcpnhqges.exe File created C:\Windows\meoetcaht\sllwubhmw8c5 dqgqjrd.exe File created C:\Windows\meoetcaht\sllwubhmw8c5 lcpnhqges.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2336 lcpnhqges.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe 2732 dqgqjrd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3020 wrote to memory of 1912 3020 57b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b.exe 28 PID 3020 wrote to memory of 1912 3020 57b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b.exe 28 PID 3020 wrote to memory of 1912 3020 57b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b.exe 28 PID 3020 wrote to memory of 1912 3020 57b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b.exe 28 PID 2336 wrote to memory of 2732 2336 lcpnhqges.exe 30 PID 2336 wrote to memory of 2732 2336 lcpnhqges.exe 30 PID 2336 wrote to memory of 2732 2336 lcpnhqges.exe 30 PID 2336 wrote to memory of 2732 2336 lcpnhqges.exe 30 PID 1912 wrote to memory of 2804 1912 t2gf4afrlddqvqigvpxg.exe 31 PID 1912 wrote to memory of 2804 1912 t2gf4afrlddqvqigvpxg.exe 31 PID 1912 wrote to memory of 2804 1912 t2gf4afrlddqvqigvpxg.exe 31 PID 1912 wrote to memory of 2804 1912 t2gf4afrlddqvqigvpxg.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\57b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b.exe"C:\Users\Admin\AppData\Local\Temp\57b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\meoetcaht\t2gf4afrlddqvqigvpxg.exe"C:\meoetcaht\t2gf4afrlddqvqigvpxg.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\meoetcaht\lcpnhqges.exe"C:\meoetcaht\lcpnhqges.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2804
-
-
-
C:\meoetcaht\lcpnhqges.exeC:\meoetcaht\lcpnhqges.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\meoetcaht\dqgqjrd.exejaxx3i3xzoxp "c:\meoetcaht\lcpnhqges.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2732
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10B
MD5f3abe222e5a02f1e8caf70a296fde33a
SHA14a9d0afef11eb55fb3ba0876d27336f5ac4c6da9
SHA2563b89a9364c98975b7b8d41d19b2040a1399a59dfed226d447f285a6e833d0673
SHA512c40ae03bd6656012512bb15eaf5591d4ea18191b2a29c2f536271d5ae0d7f7566e6af428d406a9cb479c6ca7b225f707c1ce56f88eec4c216a4f4b6cd2e03cd1
-
Filesize
274KB
MD50ae678ad8ad46e391cb05fee3062a863
SHA1380d364a1bee328d54ab9e96ce7b3526ac5e7527
SHA25657b3f3005273e5e182264b776eea234084a1160c0d6709849746c07cc3ad7f7b
SHA5123f21d6d70c195081a5d36ed147cbbc25d07300572eb5f9d5c9a39a24fdf03000065d460e2f4c984832b1939c2e852eb4209db11ae361a831d45a38dc6af68de5