b3c27c4c4db1ee499afb4de38367c45d4c1a00c3878fc3ba3061a44f5fbc27da

Resubmissions

21-07-2024 15:04

17-06-2024 07:34

max time kernel
1815s
max time network
1816s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 07:34

Target

RewAdIs_Launcher_v05.exe
Size

1.2MB
MD5

053487a5f68d7bb1a8fb36d07edef428
SHA1

799a6e4be54ad869319011380df12b6368024f08
SHA256

6c957cd9581d6c18df39a3b458ff6ac4d8b388cb7b66fb97ba4d314334493029
SHA512

f07722d73238226d04dad7f54b99c2f28f045d08b39d0e6133bd84a8d7316b6a84c07a2dfd2f1953c91744a036ed96f7944d8d0b638a9e7a264761096e31f18a
SSDEEP

24576:1RaZROMOm8FN7TjsPnzt2heeRhQbJEOeamDZNuFf:fkxOm+7TjsPnztyDMmawu

Score

1^/10

Suspicious use of FindShellTrayWindow 12 IoCs

Suspicious use of SendNotifyMessage 12 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1924	2792	RewAdIs_Launcher_v05.exe	28
PID 2792 wrote to memory of 1924	2792	RewAdIs_Launcher_v05.exe	28
PID 2792 wrote to memory of 1924	2792	RewAdIs_Launcher_v05.exe	28
PID 2792 wrote to memory of 1740	2792	RewAdIs_Launcher_v05.exe	30
PID 2792 wrote to memory of 1740	2792	RewAdIs_Launcher_v05.exe	30
PID 2792 wrote to memory of 1740	2792	RewAdIs_Launcher_v05.exe	30
PID 2792 wrote to memory of 2204	2792	RewAdIs_Launcher_v05.exe	32
PID 2792 wrote to memory of 2204	2792	RewAdIs_Launcher_v05.exe	32
PID 2792 wrote to memory of 2204	2792	RewAdIs_Launcher_v05.exe	32

C:\Users\Admin\AppData\Local\Temp\RewAdIs_Launcher_v05.exe
"C:\Users\Admin\AppData\Local\Temp\RewAdIs_Launcher_v05.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl https://raw.githubusercontent.com/TROguz/ndx/main/pc --ssl-no-revoke -o ndx
  2⤵
  PID:1924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del ndx
  2⤵
  PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del
  2⤵
  PID:2204