bbf86def4a51e575b86b23cf1e39d78ba89f177ee96229fc6cf657cc01b644a7

Analysis

max time kernel
136s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bbf86def4a51e575b86b23cf1e39d78ba89f177ee96229fc6cf657cc01b644a7.exe
Size 65KB
Sample240609-jps6dage86
SHA256 bbf86def4a51e575b86b23cf1e39d78ba89f177ee96229fc6cf657cc01b644a7
MD5 4995e156a8b5df7005bfc78273fac4e3
SHA1 25d556347660925e9f495bfba5dd61a2048b0f33
SHA512 88dc01bce0f5470dd07ce78bc9f02cfb0b2ae6792b7ea9d04607079cc72d8af4529e49d5011a7721aa5c36f600f72f44923da6b9d715b6cd1d378bed1202692e
SSDEEP 768:SeJIvFKPZo2smEasjcj29NWngAHxcwfppEaxglaX5uA7:SQIvEPZo6Ead29NQgA2wSle5T
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
2380	ewiuer2.exe
1536	ewiuer2.exe
2840	ewiuer2.exe
2764	ewiuer2.exe
3040	ewiuer2.exe
1464	ewiuer2.exe
1844	ewiuer2.exe

Loads dropped DLL 14 IoCs

pid	Process
2180	bbf86def4a51e575b86b23cf1e39d78ba89f177ee96229fc6cf657cc01b644a7.exe
2180	bbf86def4a51e575b86b23cf1e39d78ba89f177ee96229fc6cf657cc01b644a7.exe
2380	ewiuer2.exe
2380	ewiuer2.exe
1536	ewiuer2.exe
1536	ewiuer2.exe
2840	ewiuer2.exe
2840	ewiuer2.exe
2764	ewiuer2.exe
2764	ewiuer2.exe
3040	ewiuer2.exe
3040	ewiuer2.exe
1464	ewiuer2.exe
1464	ewiuer2.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe
File opened for modification	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe
File opened for modification	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2380	2180	bbf86def4a51e575b86b23cf1e39d78ba89f177ee96229fc6cf657cc01b644a7.exe	28
PID 2180 wrote to memory of 2380	2180	bbf86def4a51e575b86b23cf1e39d78ba89f177ee96229fc6cf657cc01b644a7.exe	28
PID 2180 wrote to memory of 2380	2180	bbf86def4a51e575b86b23cf1e39d78ba89f177ee96229fc6cf657cc01b644a7.exe	28
PID 2180 wrote to memory of 2380	2180	bbf86def4a51e575b86b23cf1e39d78ba89f177ee96229fc6cf657cc01b644a7.exe	28
PID 2380 wrote to memory of 1536	2380	ewiuer2.exe	32
PID 2380 wrote to memory of 1536	2380	ewiuer2.exe	32
PID 2380 wrote to memory of 1536	2380	ewiuer2.exe	32
PID 2380 wrote to memory of 1536	2380	ewiuer2.exe	32
PID 1536 wrote to memory of 2840	1536	ewiuer2.exe	33
PID 1536 wrote to memory of 2840	1536	ewiuer2.exe	33
PID 1536 wrote to memory of 2840	1536	ewiuer2.exe	33
PID 1536 wrote to memory of 2840	1536	ewiuer2.exe	33
PID 2840 wrote to memory of 2764	2840	ewiuer2.exe	35
PID 2840 wrote to memory of 2764	2840	ewiuer2.exe	35
PID 2840 wrote to memory of 2764	2840	ewiuer2.exe	35
PID 2840 wrote to memory of 2764	2840	ewiuer2.exe	35
PID 2764 wrote to memory of 3040	2764	ewiuer2.exe	36
PID 2764 wrote to memory of 3040	2764	ewiuer2.exe	36
PID 2764 wrote to memory of 3040	2764	ewiuer2.exe	36
PID 2764 wrote to memory of 3040	2764	ewiuer2.exe	36
PID 3040 wrote to memory of 1464	3040	ewiuer2.exe	38
PID 3040 wrote to memory of 1464	3040	ewiuer2.exe	38
PID 3040 wrote to memory of 1464	3040	ewiuer2.exe	38
PID 3040 wrote to memory of 1464	3040	ewiuer2.exe	38
PID 1464 wrote to memory of 1844	1464	ewiuer2.exe	39
PID 1464 wrote to memory of 1844	1464	ewiuer2.exe	39
PID 1464 wrote to memory of 1844	1464	ewiuer2.exe	39
PID 1464 wrote to memory of 1844	1464	ewiuer2.exe	39

C:\Users\Admin\AppData\Local\Temp\bbf86def4a51e575b86b23cf1e39d78ba89f177ee96229fc6cf657cc01b644a7.exe
"C:\Users\Admin\AppData\Local\Temp\bbf86def4a51e575b86b23cf1e39d78ba89f177ee96229fc6cf657cc01b644a7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\ewiuer2.exe
    C:\Windows\System32\ewiuer2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Windows\SysWOW64\ewiuer2.exe
        
        C:\Windows\System32\ewiuer2.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2764
      - C:\Users\Admin\AppData\Roaming\ewiuer2.exe
        
        C:\Users\Admin\AppData\Roaming\ewiuer2.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\SysWOW64\ewiuer2.exe
        
        C:\Windows\System32\ewiuer2.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Users\Admin\AppData\Roaming\ewiuer2.exe
        
        C:\Users\Admin\AppData\Roaming\ewiuer2.exe
        8⤵
        Executes dropped EXE
        
        PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

1K4RWY19.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1K4RWY19.txt
Size 229B
SHA256 01c598e6e4425feecfd6705e56f22f794fb4d1fc63fe7680fb802f0bb5b0871a
MD5 00d073c6b503f4119e75629dadf4dde3
SHA1 f37cbfa62d2ec22545147ce429b3e34e31769dd3
SHA512 cf65bdf27cf5962d0506b622dc73f083c87bbe850a7fd715f8dd3a08e8dfd2d4e5aada3d2b128d7ef28cfc3a1186517f1d691d030fe1b2402788d7c8151de028
MD5 SHA1 SHA512

Submit Download

TF33MNLU.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TF33MNLU.txt
Size 230B
SHA256 07f1c9e76042f27872ff7794aaef4f278d7d30e5e70b694088fee86f35dd4ff8
MD5 bfeb63b9b9e87bba4c047732a129194b
SHA1 0cfe9ee98ee489d7a93805f0b45991378cde5f35
SHA512 dec338f66f21368f1739a8d6b3084330600de3f9722748163c23f8610fa70662c073cdeee9b8b23a671589cfba55f56a57d22b1d38ee0c2aeb291c6a722dea21
MD5 SHA1 SHA512

Submit Download

ewiuer2.exe

Path C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Size 65KB
SHA256 78f91b222364a58e8a3e5cae1617cfba766b7bb139114f69d729c1ea8055e2c9
MD5 e14ddb592d04a972cc22121551a8b246
SHA1 595b1e119128c8dfde525e956b4326c7c8911df9
SHA512 8ce0956f1543180503e3f08ce642add8033a8d4e4e33878f1bf36af95cccc8b369904fa3a21a52ba07d06ea23b4fe7a7e8fd7db2e25b7dcc83b00a27407e3731
SSDEEP 768:seJIvFKPZo2smEasjcj29NWngAHxcwfppEaxglaX5uA7:sQIvEPZo6Ead29NQgA2wSle5T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewiuer2.exe

Path C:\Windows\SysWOW64\ewiuer2.exe
Size 65KB
SHA256 549aacfc15bf3e45bf57977055358817b7f7a469a55c074d30b5b77d92a82d83
MD5 20b5d25374deb58f2a7be0298b3202b5
SHA1 8de20bd637cba5338bab048433dddbfc9fb1ebc9
SHA512 59cca4f568383c6b244b876ef8e220307337741946dbf170b105049185f66a432f148ba9424c4b423a75a032772c090bd9eadd82bd15fd88a0e853e07730157d
SSDEEP 768:ceJIvFKPZo2smEasjcj29NWngAHxcwfppEaxglaX5uA7:cQIvEPZo6Ead29NQgA2wSle5T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewiuer2.exe

Path \Users\Admin\AppData\Roaming\ewiuer2.exe
Size 65KB
SHA256 45bd5ee8639587564a7b6f5430df881876dc84d9743428a48bec029b9853d83d
MD5 ca60c479c84c0b11e35824416ada0d43
SHA1 467c5b9dcb313c729dacdc6a01e66688838d3208
SHA512 cdc354b49bdcaf7e5a012e4f6228dee270d0118375a9e9ed6d889cc1533e6de61a75454d5686eca86c3b3da8c165b4fcd40dc5ea91cc5ec125709ce3a9dab7b1
SSDEEP 768:ueJIvFKPZo2smEasjcj29NWngAHxcwfppEaxglaX5uA7:uQIvEPZo6Ead29NQgA2wSle5T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewiuer2.exe

Path \Users\Admin\AppData\Roaming\ewiuer2.exe
Size 65KB
SHA256 d36c51a35ef6e4ef4f9f9c9c76082b699cd1f099670a490b9aee65ff4b3b7ad8
MD5 b60bb5f0498798d582454608192fb00f
SHA1 64c45807d374b3b4c6351982eea6f28d9ee3372a
SHA512 5cc00a667dba0e4ac7f126462217efca780c83a82b0207a8d4d9c9b984c8cca50a7040fab1db9d011ac80bf1e71d6f0c7d6e0b2cb451f989933b45171ae8951c
SSDEEP 768:teJIvFKPZo2smEasjcj29NWngAHxcwfppEaxglaX5uA7:tQIvEPZo6Ead29NQgA2wSle5T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewiuer2.exe

Path \Users\Admin\AppData\Roaming\ewiuer2.exe
Size 65KB
SHA256 550df630ebbcbf88cf4f86a5258204a3dd13b85c377ee6fe37690206ed6b20bc
MD5 40e6ab2db8f8addea1c57ef15d10e4c1
SHA1 7402a4e71d726e6e56f475a0530bb4835c1b69b5
SHA512 e4edf29a7e64788dca418fc51905527a8fe6fa71663458be2180cdecefdf862c74c0aa8908a2cd3ea023a57ec4b250de558c4ca8f9c73376ac1c1d089c56f829
SSDEEP 768:4eJIvFKPZo2smEasjcj29NWngAHxcwfppEaxglaX5uA7:4QIvEPZo6Ead29NQgA2wSle5T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewiuer2.exe

Path \Windows\SysWOW64\ewiuer2.exe
Size 65KB
SHA256 e26e8c0d42d61e5cd1100f29b6ff7f3d5aa01d5e02c92582681fa70627e4921d
MD5 150d2fc1d62ed65ca3ba36ab3e324f5f
SHA1 4ff1deb5f7d0d3e0f9157308644934131bda8464
SHA512 9abc98f7d151a03979be0deaa52e33a1ae6b687aebb742d957816b8acf2d6ef646b5b0da98ab7cef5a184564e88fe095be08c16c647a682a48f9eea9ee399588
SSDEEP 768:peJIvFKPZo2smEasjcj29NWngAHxcwfppEaxglaX5uA7:pQIvEPZo6Ead29NQgA2wSle5T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewiuer2.exe

Path \Windows\SysWOW64\ewiuer2.exe
Size 65KB
SHA256 ae19c5d55f13fbb08eb500efd239a433d58902999f4300f3b88abbf4b18ba6d6
MD5 0a581822f5842998149e72f2a724820f
SHA1 38210d34322d1a95683ecb14ecdb2d382179ae92
SHA512 9a70d1bab4bb861f9ab28a045c1c309d8a91a3f1c9c262b084eb7494d896d3d09279e60be22c1b40440d9755e895942120ad1eff65a6de21eefb208780264252
SSDEEP 768:AeJIvFKPZo2smEasjcj29NWngAHxcwfppEaxglaX5uA7:AQIvEPZo6Ead29NQgA2wSle5T
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1464-73-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1464-82-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1536-32-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1844-84-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2180-1-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2380-23-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2380-16-0x00000000020F0000-0x000000000211A000-memory.dmp

Download

memory/2380-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2380-10-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2764-57-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2764-48-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2840-46-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2840-36-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2840-34-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3040-59-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3040-61-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3040-72-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads