66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
66s
max time network
125s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/nRi28Wtqb1.exe
Size 5.6MB
Sample240811-3bewdaybpc
SHA256 3a5576c4e7d9ed56cc295fea24ef0fa68cf4235dfefa434caa32015887e757c3
MD5 872b0fa8c0306040f181d08c5d7a252b
SHA1 a08cf74361c96aa4d7e4503af6563c63b95f1973
SHA512 23d8610ac8bfcb68695b652dd8d35edcc5f17994c90966ef0cabf11489d983cc852dd8e6d36ec85c78ec6f63cb6a7b21238a6d9687494f3ef99bc7ca86a4a277
SSDEEP 98304:GRx4heu/+/tswG+PJPigEtVTH41ZE6HqM/aZeOO4wZivrH/LXmfI1ZWQpy:GL4gy+/tbG+PJa3txT6KKaLbwZivrjdJ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2444	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe
2296	nRi28Wtqb1.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2800	2296	nRi28Wtqb1.exe	31
PID 2296 wrote to memory of 2800	2296	nRi28Wtqb1.exe	31
PID 2296 wrote to memory of 2800	2296	nRi28Wtqb1.exe	31
PID 2800 wrote to memory of 612	2800	cmd.exe	32
PID 2800 wrote to memory of 612	2800	cmd.exe	32
PID 2800 wrote to memory of 612	2800	cmd.exe	32
PID 2800 wrote to memory of 2464	2800	cmd.exe	33
PID 2800 wrote to memory of 2464	2800	cmd.exe	33
PID 2800 wrote to memory of 2464	2800	cmd.exe	33
PID 2800 wrote to memory of 2820	2800	cmd.exe	34
PID 2800 wrote to memory of 2820	2800	cmd.exe	34
PID 2800 wrote to memory of 2820	2800	cmd.exe	34
PID 2296 wrote to memory of 2696	2296	nRi28Wtqb1.exe	35
PID 2296 wrote to memory of 2696	2296	nRi28Wtqb1.exe	35
PID 2296 wrote to memory of 2696	2296	nRi28Wtqb1.exe	35
PID 2296 wrote to memory of 2176	2296	nRi28Wtqb1.exe	36
PID 2296 wrote to memory of 2176	2296	nRi28Wtqb1.exe	36
PID 2296 wrote to memory of 2176	2296	nRi28Wtqb1.exe	36
PID 2176 wrote to memory of 2432	2176	cmd.exe	37
PID 2176 wrote to memory of 2432	2176	cmd.exe	37
PID 2176 wrote to memory of 2432	2176	cmd.exe	37
PID 2296 wrote to memory of 2100	2296	nRi28Wtqb1.exe	39
PID 2296 wrote to memory of 2100	2296	nRi28Wtqb1.exe	39
PID 2296 wrote to memory of 2100	2296	nRi28Wtqb1.exe	39
PID 2432 wrote to memory of 2444	2432	cmd.exe	40
PID 2432 wrote to memory of 2444	2432	cmd.exe	40
PID 2432 wrote to memory of 2444	2432	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Unlock All\nRi28Wtqb1.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Unlock All\nRi28Wtqb1.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Unlock All\nRi28Wtqb1.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Unlock All\nRi28Wtqb1.exe" MD5
    3⤵
    PID:612
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2464
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session not found. Use latest code. You can only have app opened 1 at a time. && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session not found. Use latest code. You can only have app opened 1 at a time. && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2296 -s 4384
  2⤵
  PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-6-0x000000013F4E8000-0x000000013F885000-memory.dmp

Download

memory/2296-4-0x0000000077A20000-0x0000000077A22000-memory.dmp

Download

memory/2296-2-0x0000000077A20000-0x0000000077A22000-memory.dmp

Download

memory/2296-0-0x0000000077A20000-0x0000000077A22000-memory.dmp

Download

memory/2296-5-0x000000013F450000-0x000000013FE1D000-memory.dmp

Download

memory/2296-10-0x000000013F4E8000-0x000000013F885000-memory.dmp

Download

memory/2296-11-0x000000013F450000-0x000000013FE1D000-memory.dmp

Download

memory/2296-12-0x000000013F450000-0x000000013FE1D000-memory.dmp

Download