66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 23:20

Target

Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/Byr723V3Cq1.exe
Size

5.6MB
MD5

05396b1d29a97b383fbd638b1f9355a9
SHA1

34123ced194bfb10bab574555784e4bf43b97c8c
SHA256

f7b154b559d43433246b75a5294f260ecf11a1e03a77264b037c9d54a14315da
SHA512

b4de31b07c9dea35c37ec4ec5ee7eb4d46fa6a25801238ee36e859166f7f46dd033dde0abcc8184a63209e9d69a79ced5103e2a97f1d0dd4827706ee35c503bd
SSDEEP

98304:ETIF0v7xEkVfXhspQU9hP3P0yM5bOxetYqzxiU6WCTHXqj97sWl+0xGL:ENvqCfRsa03PZMceDMU6WcI93zx

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Byr723V3Cq1.exe

pid process

628 Byr723V3Cq1.exe
628 Byr723V3Cq1.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3504 timeout.exe

pid	process
3504	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Byr723V3Cq1.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Byr723V3Cq1.execmd.execmd.execmd.exe

description	pid	process	target process
PID 628 wrote to memory of 3280	628	Byr723V3Cq1.exe	cmd.exe
PID 628 wrote to memory of 3280	628	Byr723V3Cq1.exe	cmd.exe
PID 3280 wrote to memory of 324	3280	cmd.exe	certutil.exe
PID 3280 wrote to memory of 324	3280	cmd.exe	certutil.exe
PID 3280 wrote to memory of 4820	3280	cmd.exe	find.exe
PID 3280 wrote to memory of 4820	3280	cmd.exe	find.exe
PID 3280 wrote to memory of 3156	3280	cmd.exe	find.exe
PID 3280 wrote to memory of 3156	3280	cmd.exe	find.exe
PID 628 wrote to memory of 3244	628	Byr723V3Cq1.exe	cmd.exe
PID 628 wrote to memory of 3244	628	Byr723V3Cq1.exe	cmd.exe
PID 628 wrote to memory of 2184	628	Byr723V3Cq1.exe	cmd.exe
PID 628 wrote to memory of 2184	628	Byr723V3Cq1.exe	cmd.exe
PID 2184 wrote to memory of 2832	2184	cmd.exe	cmd.exe
PID 2184 wrote to memory of 2832	2184	cmd.exe	cmd.exe
PID 2832 wrote to memory of 3504	2832	cmd.exe	timeout.exe
PID 2832 wrote to memory of 3504	2832	cmd.exe	timeout.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\Byr723V3Cq1.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
- Suspicious use of WriteProcessMemory
PID:3280

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\Byr723V3Cq1.exe" MD5
3⤵
PID:324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session not found. Use latest code. You can only have app opened 1 at a time. && timeout /t 5"
2⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\system32\cmd.exe
cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session not found. Use latest code. You can only have app opened 1 at a time. && timeout /t 5"
3⤵
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\system32\timeout.exe
timeout /t 5
4⤵
- Delays execution with timeout.exe
PID:3504

memory/628-3-0x00007FF6512CA000-0x00007FF65166D000-memory.dmp

Filesize
3.6MB

Download
memory/628-0-0x00007FF9E9090000-0x00007FF9E9092000-memory.dmp

Filesize
8KB

Download
memory/628-1-0x00007FF651230000-0x00007FF651C0F000-memory.dmp

Filesize
9.9MB

Download
memory/628-7-0x00007FF651230000-0x00007FF651C0F000-memory.dmp

Filesize
9.9MB

Download
memory/628-6-0x00007FF6512CA000-0x00007FF65166D000-memory.dmp

Filesize
3.6MB

Download
memory/628-8-0x00007FF651230000-0x00007FF651C0F000-memory.dmp

Filesize
9.9MB

Download