e566ee2189f830504af1cb787279111b7b2f3817a61a85bad8d9810701dd4877

Submit
Reports

Overview

overview

Static

static

0715240d1a...ce.exe

windows7-x64

07fec2205c...42.exe

windows7-x64

10dc6e128c...c0.exe

windows7-x64

133bf8be0c...de.exe

windows7-x64

139a8bb2c5...c1.exe

windows7-x64

19f7d53c4a...a0.exe

windows7-x64

2896b38ec3...9c.exe

windows7-x64

2d301697ff...f4.exe

windows7-x64

3337576503...d8.exe

windows7-x64

3e04fe9f42...f1.exe

windows7-x64

3e6fbc358e...45.exe

windows7-x64

3f7458e658...df.exe

windows7-x64

434ea9832e...27.exe

windows7-x64

47792144c9...6f.exe

windows7-x64

5114aae6e8...8c.exe

windows7-x64

537a2fd4d2...ba.exe

windows7-x64

55754358dd...1c.exe

windows7-x64

5b1caa9bec...c1.exe

windows7-x64

60c24a4c6b...21.exe

windows7-x64

63396a28b7...cc.exe

windows7-x64

78d4fce0c2...2e.exe

windows7-x64

7c27b9fef6...33.exe

windows7-x64

81689f1be9...ed.exe

windows7-x64

995a91e668...55.exe

windows7-x64

9d90421b2e...56.exe

windows7-x64

a597d34bc2...40.exe

windows7-x64

a5e6df754a...d1.exe

windows7-x64

add2850732...6b.exe

windows7-x64

b098486c49...0d.exe

windows7-x64

b923f1d2ec...ed.exe

windows7-x64

bbdac308d2...4b.exe

windows7-x64

c3fb821138...c1.exe

windows7-x64

Analysis

max time kernel
1443s
max time network
1450s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 08:54

Sharing

Copy URL

Twitter E-mail

Static task

static1

14 signatures

Behavioral task

behavioral1

Sample

0715240d1af82c1cea262cde2a286b8b400805dc1f35f49422c7ee39e00f93ce.exe

Resource

win7-20240705-en

defense_evasion execution impact persistence ransomware

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral2

Sample

07fec2205cbbf2900ede2f6a1d9a5c428ef314c1dda559c632833a9c1d121542.exe

Resource

win7-20240705-en

chaos defense_evasion evasion execution impact ransomware

windows7-x64

20 signatures

1800 seconds

Behavioral task

behavioral3

Sample

10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe

Resource

win7-20240704-en

windows7-x64

2 signatures

1800 seconds

Behavioral task

behavioral4

Sample

133bf8be0cf7003b83b03579970997d408a930e58ec2726715140520900c06de.exe

Resource

win7-20240708-en

sodinokibi persistence ransomware

windows7-x64

11 signatures

1800 seconds

Behavioral task

behavioral5

Sample

139a8bb2c5537190e747d2f651b423147018fd9a9a21bb36281d4ce1c61727c1.exe

Resource

win7-20240705-en

ransomware spyware stealer

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral6

Sample

19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe

Resource

win7-20240704-en

lockbit defense_evasion discovery evasion execution impact persistence ransomware

windows7-x64

20 signatures

1800 seconds

Behavioral task

behavioral7

Sample

2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c.exe

Resource

win7-20240705-en

sodinokibi persistence ransomware spyware stealer

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral8

Sample

2d301697ff72986171c0b2ccc979ab8e93671d640de6abad57de7d4e146b70f4.exe

Resource

win7-20240708-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral9

Sample

3337576503c3e2d8876f50191ae8995b04a4536f816025c543d0e20250598fd8.exe

Resource

win7-20240708-en

windows7-x64

2 signatures

1800 seconds

Behavioral task

behavioral10

Sample

3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe

Resource

win7-20240705-en

ransomware spyware stealer

windows7-x64

15 signatures

1800 seconds

Behavioral task

behavioral11

Sample

3e6fbc358e0204cb67a41b05771fac74f1b49737c7ab7138e415c7e9628ef545.exe

Resource

win7-20240705-en

evasion persistence privilege_escalation ransomware

windows7-x64

10 signatures

1800 seconds

Behavioral task

behavioral12

Sample

3f7458e658401c15b675db78a2e9871ca3eeff3c6e299c4545515e56b66466df.exe

Resource

win7-20240704-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral13

Sample

434ea9832e6d11d614905e3eb31c333289429095b76573f1ceb38fd10608bc27.exe

Resource

win7-20240704-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

18 signatures

1800 seconds

Behavioral task

behavioral14

Sample

47792144c9b440b3d2fbd422f68a23a8a8dfc16466d2a7430fc283a9d382826f.exe

Resource

win7-20240704-en

modiloader trojan

windows7-x64

4 signatures

1800 seconds

Behavioral task

behavioral15

Sample

5114aae6e86c7eedfbf181110e4fddfad88fe296ec590390705e00272121e48c.exe

Resource

win7-20240705-en

ransomware spyware stealer

windows7-x64

16 signatures

1800 seconds

Behavioral task

behavioral16

Sample

537a2fd4d214a212df06fb73b19ba945672eaf18d64cc30d8e99ab6a0d7cb9ba.exe

Resource

win7-20240705-en

windows7-x64

2 signatures

1800 seconds

Behavioral task

behavioral17

Sample

55754358ddd26b3c56ca27780dcc408711f8a9fc42b1c9d305d1045146f40f1c.exe

Resource

win7-20240705-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral18

Sample

5b1caa9bec8d7d7833b0e25f3e4256975c38a22c2901f8e4d99fb164dfde13c1.exe

Resource

win7-20240705-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral19

Sample

60c24a4c6b54b1f4baeaee585e5e2486bbd3ab4733de36bb28da1fdb20596e21.exe

Resource

win7-20240708-en

defense_evasion execution impact ransomware spyware stealer

windows7-x64

11 signatures

1800 seconds

Behavioral task

behavioral20

Sample

63396a28b79a7eaa60c384bcb02699398cd3b2b0c14fe9cfaf52b2ffa57798cc.exe

Resource

win7-20240705-en

defense_evasion execution impact persistence ransomware spyware stealer

windows7-x64

13 signatures

1800 seconds

Behavioral task

behavioral21

Sample

78d4fce0c253356bf72cf72f260f27a3f0f3cf0a904a3618f3011cbe0b4e882e.exe

Resource

win7-20240708-en

windows7-x64

2 signatures

1800 seconds

Behavioral task

behavioral22

Sample

7c27b9fef6e94e99092fb628716ae9114385d4d5753f72bff1221bad2eb54933.exe

Resource

win7-20240705-en

windows7-x64

5 signatures

1800 seconds

Behavioral task

behavioral23

Sample

81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

Resource

win7-20240708-en

sodinokibi ransomware

windows7-x64

5 signatures

1800 seconds

Behavioral task

behavioral24

Sample

995a91e668b85a992c8a71aed191fa0fafa3b1606bf205bef93a2457786de555.exe

Resource

win7-20240704-en

defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan

windows7-x64

30 signatures

1800 seconds

Behavioral task

behavioral25

Sample

9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe

Resource

win7-20240705-en

defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan

windows7-x64

30 signatures

1800 seconds

Behavioral task

behavioral26

Sample

a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe

Resource

win7-20240705-en

modiloader trojan

windows7-x64

4 signatures

1800 seconds

Behavioral task

behavioral27

Sample

a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe

Resource

win7-20240704-en

lockbit ransomware

windows7-x64

11 signatures

1800 seconds

Behavioral task

behavioral28

Sample

add2850732c42683ee92ba555bbffb88bf5a4eee7c51e24f15a898f2d5aff66b.exe

Resource

win7-20240708-en

medusalocker defense_evasion evasion execution impact ransomware spyware stealer trojan

windows7-x64

17 signatures

1800 seconds

Behavioral task

behavioral29

Sample

b098486c49a73591ca003f20276f1ca33605618a7167407d9f3f096bc7ec930d.exe

Resource

win7-20240704-en

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer

windows7-x64

21 signatures

1800 seconds

Behavioral task

behavioral30

Sample

b923f1d2ece074dabe58bb6a603ed5d49e8d62044a1293a37e8afbcac029dded.exe

Resource

win7-20240708-en

ransomware spyware stealer

windows7-x64

14 signatures

1800 seconds

Behavioral task

behavioral31

Sample

bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe

Resource

win7-20240704-en

defense_evasion execution impact ransomware spyware stealer

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral32

Sample

c3fb821138d38ef9a2b0c77a4a3572ca38499b2dac3530c4a5faf2f789d57fc1.exe

Resource

win7-20240708-en

defense_evasion execution impact persistence ransomware spyware stealer

windows7-x64

17 signatures

1800 seconds

Report Analysis Logs

General

Target

10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe
Size

155KB
MD5

cd7be52f7de09e277fc532a3b7006ec7
SHA1

ed9a3809734da6769abd52bdc7c83aa210522adf
SHA256

10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0
SHA512

b0560990fbca4e7747c44b07ff509c1a942425b4f38ee32e87a5e7a3c8862220bd0c5192defadd66fb0e812d64a05e6f2f332df72dc5c786b95738383c364ccf
SSDEEP

3072:l5K/B0toLwSNJ5lZHQsozTS+SMqqDL2/TrKDtG:lcytwNr1yTS+xqqDL6HKE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	1932	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2456	1932	10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe	30
PID 1932 wrote to memory of 2456	1932	10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe	30
PID 1932 wrote to memory of 2456	1932	10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe	30
PID 1932 wrote to memory of 2456	1932	10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe	30

Processes

C:\Users\Admin\AppData\Local\Temp\10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe
"C:\Users\Admin\AppData\Local\Temp\10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 88
  2⤵
  - Program crash
  PID:2456

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads