b3c27c4c4db1ee499afb4de38367c45d4c1a00c3878fc3ba3061a44f5fbc27da

Resubmissions

21-07-2024 15:04

17-06-2024 07:34

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 15:04

Target

RewAdIs_Launcher_v05.exe
Size

1.2MB
MD5

053487a5f68d7bb1a8fb36d07edef428
SHA1

799a6e4be54ad869319011380df12b6368024f08
SHA256

6c957cd9581d6c18df39a3b458ff6ac4d8b388cb7b66fb97ba4d314334493029
SHA512

f07722d73238226d04dad7f54b99c2f28f045d08b39d0e6133bd84a8d7316b6a84c07a2dfd2f1953c91744a036ed96f7944d8d0b638a9e7a264761096e31f18a
SSDEEP

24576:1RaZROMOm8FN7TjsPnzt2heeRhQbJEOeamDZNuFf:fkxOm+7TjsPnztyDMmawu

Score

1^/10

Suspicious use of FindShellTrayWindow 12 IoCs

Suspicious use of SendNotifyMessage 12 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 2416	576	RewAdIs_Launcher_v05.exe	30
PID 576 wrote to memory of 2416	576	RewAdIs_Launcher_v05.exe	30
PID 576 wrote to memory of 2416	576	RewAdIs_Launcher_v05.exe	30
PID 576 wrote to memory of 1928	576	RewAdIs_Launcher_v05.exe	32
PID 576 wrote to memory of 1928	576	RewAdIs_Launcher_v05.exe	32
PID 576 wrote to memory of 1928	576	RewAdIs_Launcher_v05.exe	32
PID 576 wrote to memory of 2420	576	RewAdIs_Launcher_v05.exe	34
PID 576 wrote to memory of 2420	576	RewAdIs_Launcher_v05.exe	34
PID 576 wrote to memory of 2420	576	RewAdIs_Launcher_v05.exe	34

C:\Users\Admin\AppData\Local\Temp\RewAdIs_Launcher_v05.exe
"C:\Users\Admin\AppData\Local\Temp\RewAdIs_Launcher_v05.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl https://raw.githubusercontent.com/TROguz/ndx/main/pc --ssl-no-revoke -o ndx
  2⤵
  PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del ndx
  2⤵
  PID:1928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del
  2⤵
  PID:2420