9c43b8f6793d12e08d84a3380c338675473db6c17838831a76d3b480b493c5c5

Submit
Reports

Overview

overview

Static

static

0c2dd9c9b9...68.exe

windows7-x64

0c2dd9c9b9...68.exe

windows10-2004-x64

0e4fc438de...91.exe

windows7-x64

0e4fc438de...91.exe

windows10-2004-x64

10849d5fae...52.dll

windows7-x64

10849d5fae...52.dll

windows10-2004-x64

170004b7b6...1c.exe

windows7-x64

170004b7b6...1c.exe

windows10-2004-x64

18db51db10...c1.dll

windows7-x64

18db51db10...c1.dll

windows10-2004-x64

1b32bfbc64...d8.exe

windows7-x64

1b32bfbc64...d8.exe

windows10-2004-x64

296281f1f1...d8.exe

windows7-x64

296281f1f1...d8.exe

windows10-2004-x64

2c2e949171...3c.exe

windows7-x64

2c2e949171...3c.exe

windows10-2004-x64

311d9f8c68...99.dll

windows7-x64

311d9f8c68...99.dll

windows10-2004-x64

4bb311ba0e...81.exe

windows7-x64

4bb311ba0e...81.exe

windows10-2004-x64

7365c4cf37...f6.dll

windows7-x64

7365c4cf37...f6.dll

windows10-2004-x64

73f00d2746...7e.exe

windows7-x64

73f00d2746...7e.exe

windows10-2004-x64

832a15b86c...dd.exe

windows7-x64

832a15b86c...dd.exe

windows10-2004-x64

8ce5a8cb0a...be.exe

windows7-x64

8ce5a8cb0a...be.exe

windows10-2004-x64

98972d73a8...70.dll

windows7-x64

98972d73a8...70.dll

windows10-2004-x64

bfd5040c97...c6.exe

windows7-x64

bfd5040c97...c6.exe

windows10-2004-x64

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-07-2024 10:22

Sharing

Copy URL

Twitter E-mail

Static task

static1

1307newbild redline

3 signatures

Behavioral task

behavioral1

Sample

0c2dd9c9b940868e85bc46857d049a057af32b8abdb93ebc6732774575013168.exe

Resource

win7-20240708-en

asyncrat persistence rat

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

0c2dd9c9b940868e85bc46857d049a057af32b8abdb93ebc6732774575013168.exe

Resource

win10v2004-20240709-en

asyncrat persistence rat

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral3

Sample

0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe

Resource

win7-20240704-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe

Resource

win10v2004-20240709-en

stealc default discovery spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral5

Sample

10849d5fae1394fde8cdf2f3b239f96347ff5f94d164d2046ff4253697f09252.dll

Resource

win7-20240705-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

10849d5fae1394fde8cdf2f3b239f96347ff5f94d164d2046ff4253697f09252.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

170004b7b6bab6c3c860a6402f9d3d8988e4f3de7682e28738c3c27ac33b0e1c.exe

Resource

win7-20240704-en

amadey e76b71 evasion trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral8

Sample

170004b7b6bab6c3c860a6402f9d3d8988e4f3de7682e28738c3c27ac33b0e1c.exe

Resource

win10v2004-20240709-en

amadey lumma redline stealc 1307newbild @logscloudyt_bot e76b71 hnew leg livetraffic discovery evasion infostealer spyware stealer trojan

windows10-2004-x64

28 signatures

150 seconds

Behavioral task

behavioral9

Sample

18db51db105a5afa46582870ca416a9284bdeda0f06c4848bbd9eef0db6aeac1.dll

Resource

win7-20240705-en

strela stealer

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

18db51db105a5afa46582870ca416a9284bdeda0f06c4848bbd9eef0db6aeac1.dll

Resource

win10v2004-20240709-en

strela stealer

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

1b32bfbc6412d6abaa2df4f530b3a7587c4f73a6cb6db93b421ecaca33e508d8.exe

Resource

win7-20240704-en

collection spyware stealer

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral12

Sample

1b32bfbc6412d6abaa2df4f530b3a7587c4f73a6cb6db93b421ecaca33e508d8.exe

Resource

win10v2004-20240709-en

collection spyware stealer

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral13

Sample

296281f1f12acb1b777d311323541065639683e2da9f883d56c35721c222e0d8.exe

Resource

win7-20240705-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

296281f1f12acb1b777d311323541065639683e2da9f883d56c35721c222e0d8.exe

Resource

win10v2004-20240709-en

stealc default discovery spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral15

Sample

2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe

Resource

win7-20240708-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe

Resource

win10v2004-20240709-en

redline 6951125327 discovery infostealer

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral17

Sample

311d9f8c68e5661348e97b7e483e7ea1b3fc08863bb3f5f585581ef081058399.dll

Resource

win7-20240704-en

strela stealer

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

311d9f8c68e5661348e97b7e483e7ea1b3fc08863bb3f5f585581ef081058399.dll

Resource

win10v2004-20240709-en

strela stealer

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral19

Sample

4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

Resource

win7-20240705-en

djvu discovery persistence ransomware

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral20

Sample

4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

Resource

win10v2004-20240709-en

djvu discovery persistence ransomware

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral21

Sample

7365c4cf371b0f66c7c948e14ae33c9a00a81929cf254bd064ec32b371756ff6.dll

Resource

win7-20240705-en

strela stealer

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral22

Sample

7365c4cf371b0f66c7c948e14ae33c9a00a81929cf254bd064ec32b371756ff6.dll

Resource

win10v2004-20240709-en

strela stealer

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral23

Sample

73f00d2746a71e412b9c6d43c7f5e0ed5faf3e03730bfd6e24b8955e42c2267e.exe

Resource

win7-20240704-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral24

Sample

73f00d2746a71e412b9c6d43c7f5e0ed5faf3e03730bfd6e24b8955e42c2267e.exe

Resource

win10v2004-20240709-en

redline logsdiller cloud (tg: @logsdillabot)discovery infostealer spyware stealer

windows10-2004-x64

9 signatures

150 seconds

Behavioral task

behavioral25

Sample

832a15b86c6ab8cc88944a3c53df4f81825c799e3cc7eac48d9e3d487d007add.exe

Resource

win7-20240708-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

832a15b86c6ab8cc88944a3c53df4f81825c799e3cc7eac48d9e3d487d007add.exe

Resource

win10v2004-20240709-en

stealc default discovery spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral27

Sample

8ce5a8cb0a900826dad8a42ce81540e58e9ea3ac7b4c6235db82074589c4a3be.exe

Resource

win7-20240704-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

8ce5a8cb0a900826dad8a42ce81540e58e9ea3ac7b4c6235db82074589c4a3be.exe

Resource

win10v2004-20240709-en

redline 6951125327 discovery infostealer

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral29

Sample

98972d73a823165a52ed8ce9d295250be083884d142c92c3268936c5269fac70.dll

Resource

win7-20240704-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral30

Sample

98972d73a823165a52ed8ce9d295250be083884d142c92c3268936c5269fac70.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral31

Sample

bfd5040c9750dc045214de1282ae9c211eca9d9e452c2310dbf40dfa7bb426c6.exe

Resource

win7-20240704-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral32

Sample

bfd5040c9750dc045214de1282ae9c211eca9d9e452c2310dbf40dfa7bb426c6.exe

Resource

win10v2004-20240709-en

redline 6951125327 discovery infostealer

windows10-2004-x64

7 signatures

150 seconds

Report Analysis Logs

General

Target

2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe
Size

338KB
MD5

6f1e400bcf79c773832b3ca2aab94d3d
SHA1

8a1724e7f0df1b8bb22413751908b76f72498121
SHA256

2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c
SHA512

2459d2e2b39987ebcf635a2867b67d8b5ae7c865157fe1ad32513fb0dcae0d226532d2416d4fc23c347add8a9d741ba3d15e662c3e2a01cf316046b1fab1254a
SSDEEP

6144:mY1jumalKcYdvkMEdRE29UHYOhQWr6vSuwgeBNsCri5rg/73LM+L2di8bEO:maEKc+kMcIOauwgeBPi5rgz3L4i8bEO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	2644	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2208	2644	2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe	31
PID 2644 wrote to memory of 2208	2644	2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe	31
PID 2644 wrote to memory of 2208	2644	2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe	31
PID 2644 wrote to memory of 2208	2644	2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe	31

Processes

C:\Users\Admin\AppData\Local\Temp\2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe
"C:\Users\Admin\AppData\Local\Temp\2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 108
  2⤵
  - Program crash
  PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2644-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download