c18e91fedad79cf98044d7a754dd39b673018e28dc6935bc9d63515b8d91a6be

Analysis

max time kernel
146s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
351650a422e427140d74d8c68185fa24.exe
Size 1.1MB
Sample240608-tsg8dsdb9v
SHA256 c18e91fedad79cf98044d7a754dd39b673018e28dc6935bc9d63515b8d91a6be
MD5 351650a422e427140d74d8c68185fa24
SHA1 c20e19d924a55302e8d642ced835643df817b408
SHA512 b2b48979e2e93ddecf931e7b32a8678204fe3227deb3d14a1b0a5e37dc6184250849e1212ccf33f204ae4445cc4d45660463328c2fc0f1944ba66c40440bcd39
SSDEEP 24576:4AHnh+eWsN3skA4RV1Hom2KXMmHa1njQfaHqX94tnjcHjajCF45N5:/h+ZkldoPK8Ya1njwaKXKtnjjjPF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1320	.exe

Loads dropped DLL 1 IoCs

pid	Process
2988	351650a422e427140d74d8c68185fa24.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000014353-13.dat	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1320 set thread context of 2748	1320	.exe	29
PID 2748 set thread context of 1216	2748	svchost.exe	21
PID 2748 set thread context of 2784	2748	svchost.exe	30
PID 2784 set thread context of 1216	2784	netbtugc.exe	21

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2748	svchost.exe
2748	svchost.exe
2748	svchost.exe
2748	svchost.exe
2748	svchost.exe
2748	svchost.exe
2748	svchost.exe
2748	svchost.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe
2784	netbtugc.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1320	.exe
2748	svchost.exe
1216	Explorer.EXE
1216	Explorer.EXE
2784	netbtugc.exe
2784	netbtugc.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2988	351650a422e427140d74d8c68185fa24.exe
2988	351650a422e427140d74d8c68185fa24.exe
1320	.exe
1320	.exe
1216	Explorer.EXE
1216	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2988	351650a422e427140d74d8c68185fa24.exe
2988	351650a422e427140d74d8c68185fa24.exe
1320	.exe
1320	.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1320	2988	351650a422e427140d74d8c68185fa24.exe	28
PID 2988 wrote to memory of 1320	2988	351650a422e427140d74d8c68185fa24.exe	28
PID 2988 wrote to memory of 1320	2988	351650a422e427140d74d8c68185fa24.exe	28
PID 2988 wrote to memory of 1320	2988	351650a422e427140d74d8c68185fa24.exe	28
PID 1320 wrote to memory of 2748	1320	.exe	29
PID 1320 wrote to memory of 2748	1320	.exe	29
PID 1320 wrote to memory of 2748	1320	.exe	29
PID 1320 wrote to memory of 2748	1320	.exe	29
PID 1320 wrote to memory of 2748	1320	.exe	29
PID 1216 wrote to memory of 2784	1216	Explorer.EXE	30
PID 1216 wrote to memory of 2784	1216	Explorer.EXE	30
PID 1216 wrote to memory of 2784	1216	Explorer.EXE	30
PID 1216 wrote to memory of 2784	1216	Explorer.EXE	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\351650a422e427140d74d8c68185fa24.exe
  "C:\Users\Admin\AppData\Local\Temp\351650a422e427140d74d8c68185fa24.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Users\Admin\AppData\Local\directory\.exe
    "C:\Users\Admin\AppData\Local\Temp\351650a422e427140d74d8c68185fa24.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\351650a422e427140d74d8c68185fa24.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:2748
- C:\Windows\SysWOW64\netbtugc.exe
  "C:\Windows\SysWOW64\netbtugc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

snaith

Path C:\Users\Admin\AppData\Local\Temp\snaith
Size 264KB
SHA256 62f03de61df004c2f9d1ccda1b7daa295bead15f9e4f7d3b04d2492dab0fd399
MD5 1306778ea7672dcf0feeaaccefc7834b
SHA1 c66a3f38bb0ad064904e0b0d8f4a68974a4156ea
SHA512 357b4e97722418735f322ba37634b911c31246eed9926e30bd9971b5854806625a5c3a48c8c57c691f7684d57612d12a6166330918c81e82e1663ea63bcfa923
SSDEEP 6144:gtdKYbNpCPngl6365pZ3CG+iToeh5tzIzGkB4SRu+B:rYbbdl4eCGdybuC
MD5 SHA1 SHA512 SSDEEP

Submit Download

.exe

Path \Users\Admin\AppData\Local\directory\.exe
Size 1.1MB
SHA256 c18e91fedad79cf98044d7a754dd39b673018e28dc6935bc9d63515b8d91a6be
MD5 351650a422e427140d74d8c68185fa24
SHA1 c20e19d924a55302e8d642ced835643df817b408
SHA512 b2b48979e2e93ddecf931e7b32a8678204fe3227deb3d14a1b0a5e37dc6184250849e1212ccf33f204ae4445cc4d45660463328c2fc0f1944ba66c40440bcd39
SSDEEP 24576:4AHnh+eWsN3skA4RV1Hom2KXMmHa1njQfaHqX94tnjcHjajCF45N5:/h+ZkldoPK8Ya1njwaKXKtnjjjPF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1216-38-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Download

memory/1216-48-0x0000000008DD0000-0x000000000AE61000-memory.dmp

Download

memory/1216-46-0x00000000002A0000-0x00000000002D0000-memory.dmp

Download

memory/1216-39-0x0000000008DD0000-0x000000000AE61000-memory.dmp

Download

memory/2748-33-0x0000000000720000-0x0000000000A23000-memory.dmp

Download

memory/2748-43-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/2748-37-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/2748-35-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2748-34-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2748-32-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2748-42-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2748-36-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2784-41-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/2784-44-0x0000000000870000-0x0000000000B73000-memory.dmp

Download

memory/2784-45-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/2784-40-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/2784-47-0x0000000000380000-0x0000000000420000-memory.dmp

Download

memory/2784-49-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/2988-11-0x0000000000140000-0x0000000000144000-memory.dmp

Download