Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2024, 14:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader1.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader1.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Loader1.exe
-
Size
2.3MB
-
MD5
6afcb92e2a4b1ad442409c67cd522db4
-
SHA1
4c2b5dcee1aa4f770a10e91e27f8246c3791f854
-
SHA256
9e5ab2c2a30922eb41fad6c1ce6b1fd665c6f6f4871eeb3d8b1e9172487e3618
-
SHA512
dc42a6160abc6a0f34144f7ecbb83120da02402cd32e36682d1ef8dd0dc76e77d09d3cf2a3d6b63a549eaabbdf6edf1020cd02e20de858f15ba4b2b27d0af3f9
-
SSDEEP
49152:v2y5X0g2JVMybC/eln20ZMmpR70ML92wGVUNs:v2yxfq6/eln20ZMqY4AwGVUm
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe 2340 Loader1.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2340 wrote to memory of 5048 2340 Loader1.exe 85 PID 2340 wrote to memory of 5048 2340 Loader1.exe 85 PID 5048 wrote to memory of 4292 5048 cmd.exe 86 PID 5048 wrote to memory of 4292 5048 cmd.exe 86 PID 5048 wrote to memory of 3052 5048 cmd.exe 87 PID 5048 wrote to memory of 3052 5048 cmd.exe 87 PID 5048 wrote to memory of 4632 5048 cmd.exe 88 PID 5048 wrote to memory of 4632 5048 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader1.exe"C:\Users\Admin\AppData\Local\Temp\Loader1.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader1.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader1.exe" MD53⤵PID:4292
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:3052
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:4632
-
-