8c3ec0d50dcb3d53ed59b59bdeed03a2b612eb621e5165abcac10b2263e5b2bd

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 04:26

Target
SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe
Size 876KB
Sample240616-e2h4qatcnl
SHA256 8c3ec0d50dcb3d53ed59b59bdeed03a2b612eb621e5165abcac10b2263e5b2bd
MD5 defb954877aaa262579251a39f855933
SHA1 81900aca1e422b7bfe78bc7ea2089d4f8a722168
SHA512 c9f914b87d6cb4c185f2f0b6d637a2ede287ac7b948ac5c826a2a6aeab588f054be768c7e3b168a506ebe8e2d448581b06fa49ff0937e2473b68e201e24f2943
SSDEEP 12288:R7sRowUy7oneiornbBDa222OUYxROhxSIfIkcibNb4WfTyQh:R7zwUKliornbB4HxiS6Ik/Nb4WGU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
2304	lzma.exe
2936	lzma.exe

Loads dropped DLL 4 IoCs

pid	Process
2144	SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe
2144	SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe
2144	SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe
2144	SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2304	2144	SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe	28
PID 2144 wrote to memory of 2304	2144	SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe	28
PID 2144 wrote to memory of 2304	2144	SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe	28
PID 2144 wrote to memory of 2304	2144	SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe	28
PID 2144 wrote to memory of 2936	2144	SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe	29
PID 2144 wrote to memory of 2936	2144	SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe	29
PID 2144 wrote to memory of 2936	2144	SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe	29
PID 2144 wrote to memory of 2936	2144	SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe	29

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1718511967-0-app\lzma.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1718511967-0-app\lzma.exe" "d" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1718511967-0-app\verpatch.exe.l2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1718511967-0-app\verpatch.exe"
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1718511967-0-app\lzma.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1718511967-0-app\lzma.exe" "d" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1718511967-0-app\JWrapper-JWrapper-00019224260-archive.p2.l2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1718511967-0-app\JWrapper-JWrapper-00019224260-archive.p2"
  2⤵
  - Executes dropped EXE
  PID:2936

JWrapper-JWrapper-00019224260-archive.p2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1718511967-0-app\JWrapper-JWrapper-00019224260-archive.p2
Size 1.1MB
SHA256 0032141a43109f60694ec1125d4daa98114647d09e13e0a9b0fe5a40ad24a1b2
MD5 7ed01763022e7e9a6dd4c370a1c22c07
SHA1 431676c1f0b8d85daf9f0b53d88980d240300db2
SHA512 8a9d750eeb17a846bf0bdb49122142241d0ddf0b2aadb06b016901fabc731916e060e75306b78b91a091e6550231479e4ccf6ca3d326982ed469ef95d1749806
SSDEEP 12288:PVZNTb/ZMoYiD1VOzXE8z/2fuTXRv4YNds60nFGYBl7Cq0YfW:PV3jXDGzOYN2RBl7CCfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

JWrapper-JWrapper-00019224260-archive.p2.l2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1718511967-0-app\JWrapper-JWrapper-00019224260-archive.p2.l2
Size 383KB
SHA256 a29385774d3dec077e57f16ac54ccb53fa7fb1e89a3f6c320d991f4e8b8c906b
MD5 32648a013cb28bd7056f4a8ade9f1bf6
SHA1 e4b041644dbb0ef79bd2dad5ecdc26bdfac219ee
SHA512 9c23b223ba2efbf6ed776bcefad4ae01c2528643600664d804a7f49346c1c884c6b97e8b95d6ba3819a73f1e19c2369d163e03fd0c29fc8384d559ae8f08831b
SSDEEP 6144:DfyTg+YBq22B2BPdRBevUYFqGgMUwOhx3iwfg9OR/BZI9GZK/QLbnKGwK9pn4Y5F:Da222OUYxROhxSIfIkcibNb4WfTyQ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

verpatch.exe.l2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1718511967-0-app\verpatch.exe.l2
Size 16KB
SHA256 f719964e71b47116e87fdea44a50425e462fa9036e43d7badec624f36fe86d9d
MD5 0f01ede304c8199e4b56b847be0787e0
SHA1 a73f8dd25773469a1fd3cb873d2af3a95bf46fd5
SHA512 c46acf58ac2128576cf5996724f7b759092d0e705efff641a5feb5385f1a0078b78a9d044c51a80592bb90b137a633f9453105619b7a619389744a09963bbfb7
SSDEEP 384:58RfNXgO8SoNWOmLP7tD7K1ipfIuMrPLmluNVIMtVh7aC:Y10li+1Cq+uVIi7aC
MD5 SHA1 SHA512 SSDEEP

Submit Download

lzma.exe

Path \Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1718511967-0-app\lzma.exe
Size 71KB
SHA256 410bfdaddee3767151296fe4f16052c39546151916f05bbe4ae1c6b698b18f0f
MD5 e59aa0e52e93c781dcdab8ad7cc4054c
SHA1 1be9c2d8b48d6e0c8a7cab6013cc36ea42ec421e
SHA512 d0be3580640bb2cca0c097ec2154132eeefd2b2b4b0e45027cc303c47a42f5c545d5f50182c70a69b5d1673112d24f8ae320d097d7034e810dbc0a5128b09050
SSDEEP 1536:e4iIoFd/iQuGIpJrnuRctWN5UbhYLEnCwaXEY1:e4iICd/iHVrnuGtmUBgXE0
MD5 SHA1 SHA512 SSDEEP

Submit Download