66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/Byr723V3Cq1.exe
Size 5.6MB
Sample240811-3bewdaybpc
SHA256 f7b154b559d43433246b75a5294f260ecf11a1e03a77264b037c9d54a14315da
MD5 05396b1d29a97b383fbd638b1f9355a9
SHA1 34123ced194bfb10bab574555784e4bf43b97c8c
SHA512 b4de31b07c9dea35c37ec4ec5ee7eb4d46fa6a25801238ee36e859166f7f46dd033dde0abcc8184a63209e9d69a79ced5103e2a97f1d0dd4827706ee35c503bd
SSDEEP 98304:ETIF0v7xEkVfXhspQU9hP3P0yM5bOxetYqzxiU6WCTHXqj97sWl+0xGL:ENvqCfRsa03PZMceDMU6WcI93zx
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3504	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe
628	Byr723V3Cq1.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 3280	628	Byr723V3Cq1.exe	85
PID 628 wrote to memory of 3280	628	Byr723V3Cq1.exe	85
PID 3280 wrote to memory of 324	3280	cmd.exe	86
PID 3280 wrote to memory of 324	3280	cmd.exe	86
PID 3280 wrote to memory of 4820	3280	cmd.exe	87
PID 3280 wrote to memory of 4820	3280	cmd.exe	87
PID 3280 wrote to memory of 3156	3280	cmd.exe	88
PID 3280 wrote to memory of 3156	3280	cmd.exe	88
PID 628 wrote to memory of 3244	628	Byr723V3Cq1.exe	89
PID 628 wrote to memory of 3244	628	Byr723V3Cq1.exe	89
PID 628 wrote to memory of 2184	628	Byr723V3Cq1.exe	98
PID 628 wrote to memory of 2184	628	Byr723V3Cq1.exe	98
PID 2184 wrote to memory of 2832	2184	cmd.exe	99
PID 2184 wrote to memory of 2832	2184	cmd.exe	99
PID 2832 wrote to memory of 3504	2832	cmd.exe	104
PID 2832 wrote to memory of 3504	2832	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\Byr723V3Cq1.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\Byr723V3Cq1.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\Byr723V3Cq1.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\Byr723V3Cq1.exe" MD5
    3⤵
    PID:324
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4820
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session not found. Use latest code. You can only have app opened 1 at a time. && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session not found. Use latest code. You can only have app opened 1 at a time. && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-3-0x00007FF6512CA000-0x00007FF65166D000-memory.dmp

Download

memory/628-0-0x00007FF9E9090000-0x00007FF9E9092000-memory.dmp

Download

memory/628-1-0x00007FF651230000-0x00007FF651C0F000-memory.dmp

Download

memory/628-7-0x00007FF651230000-0x00007FF651C0F000-memory.dmp

Download

memory/628-6-0x00007FF6512CA000-0x00007FF65166D000-memory.dmp

Download

memory/628-8-0x00007FF651230000-0x00007FF651C0F000-memory.dmp

Download