b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c5018a3915e8a9de41e083f7936c2d232b9a73ba41c8c07fb7b2d90d5f5d8e8e_dump.exe
Size 16KB
Sample240614-ry481avcma
SHA256 b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2
MD5 e7d405eec8052898f4d2b0440a6b72c9
SHA1 58cf7bfcec81faf744682f9479b905feed8e6e68
SHA512 324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121
SSDEEP 192:0cG7C70KVYmEDmSv+ShxlxCB5jNw56NgaaeA8J7CkXhMQzpa:0ZKGmESEH3s5jNIFadAsdXja
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.nifty.ne.jp
Port
587
Username
[email protected]
Password
1966xxxx

Extracted

Credentials

Protocol
smtp
Host
smtp.nifty.com
Port
587
Username
[email protected]
Password
GENKEN

Extracted

Credentials

Protocol
smtp
Host
smtp.frontier.com
Port
587
Username
[email protected]
Password
Letsgoeers2u

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2468	vtqg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Test Task17.job	c5018a3915e8a9de41e083f7936c2d232b9a73ba41c8c07fb7b2d90d5f5d8e8e_dump.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2468	2644	taskeng.exe	31
PID 2644 wrote to memory of 2468	2644	taskeng.exe	31
PID 2644 wrote to memory of 2468	2644	taskeng.exe	31
PID 2644 wrote to memory of 2468	2644	taskeng.exe	31

C:\Users\Admin\AppData\Local\Temp\c5018a3915e8a9de41e083f7936c2d232b9a73ba41c8c07fb7b2d90d5f5d8e8e_dump.exe
"C:\Users\Admin\AppData\Local\Temp\c5018a3915e8a9de41e083f7936c2d232b9a73ba41c8c07fb7b2d90d5f5d8e8e_dump.exe"
1⤵
- Drops file in Windows directory
PID:1932

C:\Windows\system32\taskeng.exe
taskeng.exe {83809094-09D3-4CF2-B418-C9E71CBA3B3B} S-1-5-21-39690363-730359138-1046745555-1000:EILATWEW\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\ProgramData\psnfqqm\vtqg.exe
  C:\ProgramData\psnfqqm\vtqg.exe
  2⤵
  - Executes dropped EXE
  PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

vtqg.exe

Path C:\ProgramData\psnfqqm\vtqg.exe
Size 16KB
SHA256 b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2
MD5 e7d405eec8052898f4d2b0440a6b72c9
SHA1 58cf7bfcec81faf744682f9479b905feed8e6e68
SHA512 324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121
SSDEEP 192:0cG7C70KVYmEDmSv+ShxlxCB5jNw56NgaaeA8J7CkXhMQzpa:0ZKGmESEH3s5jNIFadAsdXja
MD5 SHA1 SHA512 SSDEEP

Submit Download

Test Task17.job

Path C:\Windows\Tasks\Test Task17.job
Size 218B
SHA256 d8a903e514e7356dc7e3db96448dc8f03a75e3f2060775e9cb1162ebccdea6de
MD5 e18b4e321200ad1357caa4b53405b346
SHA1 70c9c4f4866bc1c5e8c892739257627a40a75945
SHA512 64ffa51889926de598c40e368a98da9809ad681736e4fd192237136192e244693b7325700358002fa44cf8794924725c1945ddb9fdc9a081ba9fa0a7b9f3cf35
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads