78fea7aef883193ed0be8e7b5ac1e00ff7389617692a1abc6dcd4745eefd21fa

Analysis

max time kernel
111s
max time network
16s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Und 1.8.exe
Size 118.4MB
Sample240613-e5qmzathpb
SHA256 be6d7f93a6fa2365c8ce5711a176a53b5e4f9837a6b01a6be8c9b47a1aaa2bbe
MD5 5a1afba4005477a2f8fd605caacbae59
SHA1 d186b79887989ad73d9ab3acd9f633b752e11d1f
SHA512 211dae914cf59119a3f234d03fd2f75cb6c45b27f5d3dd0f3adffaf5a57e57814cc1d02c8a2d94a9b980e640b922784a59d805b568b13fc8132fd5ed513ef0d9
SSDEEP 3145728:iuHlNm+D1LEyWCHCLhs8bB3MVfDXhFkqQTOWw:D7FDy/4CoheqcOWw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1380	Und 1.8.tmp

Loads dropped DLL 1 IoCs

pid	Process
2068	Und 1.8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1380	Und 1.8.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1380	2068	Und 1.8.exe	28
PID 2068 wrote to memory of 1380	2068	Und 1.8.exe	28
PID 2068 wrote to memory of 1380	2068	Und 1.8.exe	28
PID 2068 wrote to memory of 1380	2068	Und 1.8.exe	28
PID 2068 wrote to memory of 1380	2068	Und 1.8.exe	28
PID 2068 wrote to memory of 1380	2068	Und 1.8.exe	28
PID 2068 wrote to memory of 1380	2068	Und 1.8.exe	28

C:\Users\Admin\AppData\Local\Temp\Und 1.8.exe
"C:\Users\Admin\AppData\Local\Temp\Und 1.8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\is-OGN3V.tmp\Und 1.8.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OGN3V.tmp\Und 1.8.tmp" /SL5="$30144,123733726,121344,C:\Users\Admin\AppData\Local\Temp\Und 1.8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Und 1.8.tmp

Path \Users\Admin\AppData\Local\Temp\is-OGN3V.tmp\Und 1.8.tmp
Size 1.1MB
SHA256 821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
MD5 90fc739c83cd19766acb562c66a7d0e2
SHA1 451f385a53d5fed15e7649e7891e05f231ef549a
SHA512 4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c
SSDEEP 24576:RtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt:PqTytRFk6ek1L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1380-8-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/1380-11-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/2068-2-0x0000000000401000-0x0000000000412000-memory.dmp

Download

memory/2068-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2068-10-0x0000000000400000-0x0000000000428000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads