35ce9a93d911373f6e392d3608413d0f95c6c3b6c0d3b582dbf718211b024241

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2024 08:10

Target

nRi28Wtqb1.exe
Size

5.6MB
MD5

872b0fa8c0306040f181d08c5d7a252b
SHA1

a08cf74361c96aa4d7e4503af6563c63b95f1973
SHA256

3a5576c4e7d9ed56cc295fea24ef0fa68cf4235dfefa434caa32015887e757c3
SHA512

23d8610ac8bfcb68695b652dd8d35edcc5f17994c90966ef0cabf11489d983cc852dd8e6d36ec85c78ec6f63cb6a7b21238a6d9687494f3ef99bc7ca86a4a277
SSDEEP

98304:GRx4heu/+/tswG+PJPigEtVTH41ZE6HqM/aZeOO4wZivrH/LXmfI1ZWQpy:GL4gy+/tbG+PJa3txT6KKaLbwZivrjdJ

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

nRi28Wtqb1.exe

pid process

4456 nRi28Wtqb1.exe
4456 nRi28Wtqb1.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4996 timeout.exe

pid	process
4996	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

nRi28Wtqb1.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

nRi28Wtqb1.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4456 wrote to memory of 2172	4456	nRi28Wtqb1.exe	cmd.exe
PID 4456 wrote to memory of 2172	4456	nRi28Wtqb1.exe	cmd.exe
PID 2172 wrote to memory of 3568	2172	cmd.exe	certutil.exe
PID 2172 wrote to memory of 3568	2172	cmd.exe	certutil.exe
PID 2172 wrote to memory of 4768	2172	cmd.exe	find.exe
PID 2172 wrote to memory of 4768	2172	cmd.exe	find.exe
PID 2172 wrote to memory of 1664	2172	cmd.exe	find.exe
PID 2172 wrote to memory of 1664	2172	cmd.exe	find.exe
PID 4456 wrote to memory of 4856	4456	nRi28Wtqb1.exe	cmd.exe
PID 4456 wrote to memory of 4856	4456	nRi28Wtqb1.exe	cmd.exe
PID 4856 wrote to memory of 1592	4856	cmd.exe	cmd.exe
PID 4856 wrote to memory of 1592	4856	cmd.exe	cmd.exe
PID 1592 wrote to memory of 4996	1592	cmd.exe	timeout.exe
PID 1592 wrote to memory of 4996	1592	cmd.exe	timeout.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\nRi28Wtqb1.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\nRi28Wtqb1.exe" MD5
3⤵
PID:3568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Couldn't resolve host name && timeout /t 5"
2⤵
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\system32\cmd.exe
cmd /C "color b && title Error && echo Couldn't resolve host name && timeout /t 5"
3⤵
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\system32\timeout.exe
timeout /t 5
4⤵
- Delays execution with timeout.exe
PID:4996

memory/4456-2-0x00007FF7647E8000-0x00007FF764B85000-memory.dmp

Filesize
3.6MB

Download
memory/4456-1-0x00007FF764750000-0x00007FF76511D000-memory.dmp

Filesize
9.8MB

Download
memory/4456-0-0x00007FFDD1470000-0x00007FFDD1472000-memory.dmp

Filesize
8KB

Download
memory/4456-6-0x00007FF7647E8000-0x00007FF764B85000-memory.dmp

Filesize
3.6MB

Download
memory/4456-7-0x00007FF764750000-0x00007FF76511D000-memory.dmp

Filesize
9.8MB

Download