9c43b8f6793d12e08d84a3380c338675473db6c17838831a76d3b480b493c5c5

Submit
Reports

Overview

overview

Static

static

0c2dd9c9b9...68.exe

windows7-x64

0c2dd9c9b9...68.exe

windows10-2004-x64

0e4fc438de...91.exe

windows7-x64

0e4fc438de...91.exe

windows10-2004-x64

10849d5fae...52.dll

windows7-x64

10849d5fae...52.dll

windows10-2004-x64

170004b7b6...1c.exe

windows7-x64

170004b7b6...1c.exe

windows10-2004-x64

18db51db10...c1.dll

windows7-x64

18db51db10...c1.dll

windows10-2004-x64

1b32bfbc64...d8.exe

windows7-x64

1b32bfbc64...d8.exe

windows10-2004-x64

296281f1f1...d8.exe

windows7-x64

296281f1f1...d8.exe

windows10-2004-x64

2c2e949171...3c.exe

windows7-x64

2c2e949171...3c.exe

windows10-2004-x64

311d9f8c68...99.dll

windows7-x64

311d9f8c68...99.dll

windows10-2004-x64

4bb311ba0e...81.exe

windows7-x64

4bb311ba0e...81.exe

windows10-2004-x64

7365c4cf37...f6.dll

windows7-x64

7365c4cf37...f6.dll

windows10-2004-x64

73f00d2746...7e.exe

windows7-x64

73f00d2746...7e.exe

windows10-2004-x64

832a15b86c...dd.exe

windows7-x64

832a15b86c...dd.exe

windows10-2004-x64

8ce5a8cb0a...be.exe

windows7-x64

8ce5a8cb0a...be.exe

windows10-2004-x64

98972d73a8...70.dll

windows7-x64

98972d73a8...70.dll

windows10-2004-x64

bfd5040c97...c6.exe

windows7-x64

bfd5040c97...c6.exe

windows10-2004-x64

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17-07-2024 10:22

Sharing

Copy URL

Twitter E-mail

Static task

static1

1307newbild redline

3 signatures

Behavioral task

behavioral1

Sample

0c2dd9c9b940868e85bc46857d049a057af32b8abdb93ebc6732774575013168.exe

Resource

win7-20240708-en

asyncrat persistence rat

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

0c2dd9c9b940868e85bc46857d049a057af32b8abdb93ebc6732774575013168.exe

Resource

win10v2004-20240709-en

asyncrat persistence rat

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral3

Sample

0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe

Resource

win7-20240704-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe

Resource

win10v2004-20240709-en

stealc default discovery spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral5

Sample

10849d5fae1394fde8cdf2f3b239f96347ff5f94d164d2046ff4253697f09252.dll

Resource

win7-20240705-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

10849d5fae1394fde8cdf2f3b239f96347ff5f94d164d2046ff4253697f09252.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

170004b7b6bab6c3c860a6402f9d3d8988e4f3de7682e28738c3c27ac33b0e1c.exe

Resource

win7-20240704-en

amadey e76b71 evasion trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral8

Sample

170004b7b6bab6c3c860a6402f9d3d8988e4f3de7682e28738c3c27ac33b0e1c.exe

Resource

win10v2004-20240709-en

amadey lumma redline stealc 1307newbild @logscloudyt_bot e76b71 hnew leg livetraffic discovery evasion infostealer spyware stealer trojan

windows10-2004-x64

28 signatures

150 seconds

Behavioral task

behavioral9

Sample

18db51db105a5afa46582870ca416a9284bdeda0f06c4848bbd9eef0db6aeac1.dll

Resource

win7-20240705-en

strela stealer

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

18db51db105a5afa46582870ca416a9284bdeda0f06c4848bbd9eef0db6aeac1.dll

Resource

win10v2004-20240709-en

strela stealer

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

1b32bfbc6412d6abaa2df4f530b3a7587c4f73a6cb6db93b421ecaca33e508d8.exe

Resource

win7-20240704-en

collection spyware stealer

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral12

Sample

1b32bfbc6412d6abaa2df4f530b3a7587c4f73a6cb6db93b421ecaca33e508d8.exe

Resource

win10v2004-20240709-en

collection spyware stealer

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral13

Sample

296281f1f12acb1b777d311323541065639683e2da9f883d56c35721c222e0d8.exe

Resource

win7-20240705-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

296281f1f12acb1b777d311323541065639683e2da9f883d56c35721c222e0d8.exe

Resource

win10v2004-20240709-en

stealc default discovery spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral15

Sample

2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe

Resource

win7-20240708-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe

Resource

win10v2004-20240709-en

redline 6951125327 discovery infostealer

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral17

Sample

311d9f8c68e5661348e97b7e483e7ea1b3fc08863bb3f5f585581ef081058399.dll

Resource

win7-20240704-en

strela stealer

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

311d9f8c68e5661348e97b7e483e7ea1b3fc08863bb3f5f585581ef081058399.dll

Resource

win10v2004-20240709-en

strela stealer

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral19

Sample

4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

Resource

win7-20240705-en

djvu discovery persistence ransomware

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral20

Sample

4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

Resource

win10v2004-20240709-en

djvu discovery persistence ransomware

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral21

Sample

7365c4cf371b0f66c7c948e14ae33c9a00a81929cf254bd064ec32b371756ff6.dll

Resource

win7-20240705-en

strela stealer

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral22

Sample

7365c4cf371b0f66c7c948e14ae33c9a00a81929cf254bd064ec32b371756ff6.dll

Resource

win10v2004-20240709-en

strela stealer

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral23

Sample

73f00d2746a71e412b9c6d43c7f5e0ed5faf3e03730bfd6e24b8955e42c2267e.exe

Resource

win7-20240704-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral24

Sample

73f00d2746a71e412b9c6d43c7f5e0ed5faf3e03730bfd6e24b8955e42c2267e.exe

Resource

win10v2004-20240709-en

redline logsdiller cloud (tg: @logsdillabot)discovery infostealer spyware stealer

windows10-2004-x64

9 signatures

150 seconds

Behavioral task

behavioral25

Sample

832a15b86c6ab8cc88944a3c53df4f81825c799e3cc7eac48d9e3d487d007add.exe

Resource

win7-20240708-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

832a15b86c6ab8cc88944a3c53df4f81825c799e3cc7eac48d9e3d487d007add.exe

Resource

win10v2004-20240709-en

stealc default discovery spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral27

Sample

8ce5a8cb0a900826dad8a42ce81540e58e9ea3ac7b4c6235db82074589c4a3be.exe

Resource

win7-20240704-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

8ce5a8cb0a900826dad8a42ce81540e58e9ea3ac7b4c6235db82074589c4a3be.exe

Resource

win10v2004-20240709-en

redline 6951125327 discovery infostealer

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral29

Sample

98972d73a823165a52ed8ce9d295250be083884d142c92c3268936c5269fac70.dll

Resource

win7-20240704-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral30

Sample

98972d73a823165a52ed8ce9d295250be083884d142c92c3268936c5269fac70.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral31

Sample

bfd5040c9750dc045214de1282ae9c211eca9d9e452c2310dbf40dfa7bb426c6.exe

Resource

win7-20240704-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral32

Sample

bfd5040c9750dc045214de1282ae9c211eca9d9e452c2310dbf40dfa7bb426c6.exe

Resource

win10v2004-20240709-en

redline 6951125327 discovery infostealer

windows10-2004-x64

7 signatures

150 seconds

Report Analysis Logs

General

Target

8ce5a8cb0a900826dad8a42ce81540e58e9ea3ac7b4c6235db82074589c4a3be.exe
Size

338KB
MD5

9d2d8cc143e8ae3b05a78fb3b93fda65
SHA1

ec06189c3b1db47604616880366f17c287b4e30a
SHA256

8ce5a8cb0a900826dad8a42ce81540e58e9ea3ac7b4c6235db82074589c4a3be
SHA512

22ba15c3d3f293b8ae173ae83020f3192adfbeb8370c4e48761168671921540a9b1068275d187da313b9b143fd33868c026e1fd9284fab566572bfb68acc4fd5
SSDEEP

6144:wY1jDmalKcYdvkMEdRE29UHYOhQWrWNSErEENT9s76FF6Gq3cH2di8bEO:wjEKc+kMcIwSgNFF6fcii8bEO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2144	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 3020	2144	8ce5a8cb0a900826dad8a42ce81540e58e9ea3ac7b4c6235db82074589c4a3be.exe	29
PID 2144 wrote to memory of 3020	2144	8ce5a8cb0a900826dad8a42ce81540e58e9ea3ac7b4c6235db82074589c4a3be.exe	29
PID 2144 wrote to memory of 3020	2144	8ce5a8cb0a900826dad8a42ce81540e58e9ea3ac7b4c6235db82074589c4a3be.exe	29
PID 2144 wrote to memory of 3020	2144	8ce5a8cb0a900826dad8a42ce81540e58e9ea3ac7b4c6235db82074589c4a3be.exe	29

Processes

C:\Users\Admin\AppData\Local\Temp\8ce5a8cb0a900826dad8a42ce81540e58e9ea3ac7b4c6235db82074589c4a3be.exe
"C:\Users\Admin\AppData\Local\Temp\8ce5a8cb0a900826dad8a42ce81540e58e9ea3ac7b4c6235db82074589c4a3be.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 108
  2⤵
  - Program crash
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download