Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 02:50
Static task
static1
Behavioral task
behavioral1
Sample
e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe
Resource
win7-20240611-en
General
-
Target
e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe
-
Size
1.2MB
-
MD5
ca8e6c01282b57405ae4b2af66adbafa
-
SHA1
dab881b117a4e3515ff9315e30ce1a0a814ad42d
-
SHA256
e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c
-
SHA512
e8bffdcd21fa92b902b2b3b0e1dee8ce38b2c9956758acd217b1b89a085d435bac293a7d11cacd043855fcb999c8d302af42ad8d340af748834013c1875a6da4
-
SSDEEP
24576:CAHnh+eWsN3skA4RV1Hom2KXMmHa7cldzvKO1X3JWCRYj3m25:Fh+ZkldoPK8Ya7yd+Od3BRUj
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
name.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe -
Executes dropped EXE 1 IoCs
Processes:
name.exepid process 1664 name.exe -
Loads dropped DLL 1 IoCs
Processes:
e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exepid process 288 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \Users\Admin\AppData\Local\directory\name.exe autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
name.exesvchost.exerundll32.exedescription pid process target process PID 1664 set thread context of 2556 1664 name.exe svchost.exe PID 2556 set thread context of 1168 2556 svchost.exe Explorer.EXE PID 2556 set thread context of 2464 2556 svchost.exe rundll32.exe PID 2464 set thread context of 1168 2464 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
svchost.exerundll32.exepid process 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
name.exesvchost.exerundll32.exepid process 1664 name.exe 2556 svchost.exe 2556 svchost.exe 2464 rundll32.exe 2464 rundll32.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exename.exeExplorer.EXEpid process 288 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe 288 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe 1664 name.exe 1664 name.exe 1168 Explorer.EXE 1168 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exename.exepid process 288 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe 288 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe 1664 name.exe 1664 name.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exename.exesvchost.exedescription pid process target process PID 288 wrote to memory of 1664 288 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe name.exe PID 288 wrote to memory of 1664 288 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe name.exe PID 288 wrote to memory of 1664 288 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe name.exe PID 288 wrote to memory of 1664 288 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe name.exe PID 1664 wrote to memory of 2556 1664 name.exe svchost.exe PID 1664 wrote to memory of 2556 1664 name.exe svchost.exe PID 1664 wrote to memory of 2556 1664 name.exe svchost.exe PID 1664 wrote to memory of 2556 1664 name.exe svchost.exe PID 1664 wrote to memory of 2556 1664 name.exe svchost.exe PID 2556 wrote to memory of 2464 2556 svchost.exe rundll32.exe PID 2556 wrote to memory of 2464 2556 svchost.exe rundll32.exe PID 2556 wrote to memory of 2464 2556 svchost.exe rundll32.exe PID 2556 wrote to memory of 2464 2556 svchost.exe rundll32.exe PID 2556 wrote to memory of 2464 2556 svchost.exe rundll32.exe PID 2556 wrote to memory of 2464 2556 svchost.exe rundll32.exe PID 2556 wrote to memory of 2464 2556 svchost.exe rundll32.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe"C:\Users\Admin\AppData\Local\Temp\e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe"2⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2464
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD52456358082381cfbd59c47ddaa58edec
SHA1498b677a53f41f660f095ef549280dc23a43b680
SHA256f9e93076b397c10d887645865170f0fb0a0dd4fcaae025d62563412430d82f93
SHA512a3767b7c724e1b8abc3bc1e525eb89d6523205e96fb3e8c244cc6ef6cf2594d929860df25d2bb7277713be9a6846282c1527b68f81ac74c32acd4e5162e6a6df
-
Filesize
265KB
MD5da0227fbe8330d1408a4d3faa465be0a
SHA1ee14a891e166d16850b4883311ee05584735165a
SHA2565a388efe7461b3845cbd5f9ff89f97937fbdf08edf226646d27421d393ee9825
SHA512365240a84c7935bf4021d494261a0a7511a1f5da98a54a5eabad77f3ce06c3a8bd8d3bf43c10ae90a53f1cf1604d2cfcb6892da3443187e0af02eb86d968bf01
-
Filesize
1.2MB
MD5ca8e6c01282b57405ae4b2af66adbafa
SHA1dab881b117a4e3515ff9315e30ce1a0a814ad42d
SHA256e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c
SHA512e8bffdcd21fa92b902b2b3b0e1dee8ce38b2c9956758acd217b1b89a085d435bac293a7d11cacd043855fcb999c8d302af42ad8d340af748834013c1875a6da4