265bb10413b15be42cf03007a417f5a0edb52d126418d554c4d745a282d73c40 | Triage

Resubmissions

02/09/2024, 14:00

240902-ra95ca1hnl 7

Analysis

max time kernel
63s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 14:00

Sharing

Report Analysis Logs

General

Target

EvilSide_Loader_v1.1.exe
Size

566KB
MD5

5848e33da82ed47b0afcaf46aec5de7e
SHA1

c4be79f940dff8595e9ea4d1226de73768d0a105
SHA256

265bb10413b15be42cf03007a417f5a0edb52d126418d554c4d745a282d73c40
SHA512

282fff9a806c589f27afe19901f9fd147d6ed42bf169842e845f47655688b08016d778662aa68ac22503960a22e06285e82829806f0796bf428bb20ef812d758
SSDEEP

12288:deV5Tjfj0w+/NZCHWj8KHD1af22Obh4nmbv:defjfAwkMHWT4n2v

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4472	convar.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 392	2936	EvilSide_Loader_v1.1.exe	103
PID 2936 wrote to memory of 392	2936	EvilSide_Loader_v1.1.exe	103
PID 2936 wrote to memory of 4472	2936	EvilSide_Loader_v1.1.exe	104
PID 2936 wrote to memory of 4472	2936	EvilSide_Loader_v1.1.exe	104

C:\Users\Admin\AppData\Local\Temp\EvilSide_Loader_v1.1.exe
"C:\Users\Admin\AppData\Local\Temp\EvilSide_Loader_v1.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:392
- C:\Users\Admin\AppData\Local\Temp\convar.exe
  "convar.exe"
  2⤵
  - Executes dropped EXE
  PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1996,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
1⤵
PID:4928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\convar.exe

Filesize
526KB

MD5
67fea70c332469d6fb64bc4194318353

SHA1
66de0263849f8e2444437c8dab0692dd56e682d3

SHA256
ebd7f424bfe247f5975cb14a363ef6235f3f6ee8d91396dde5b8c2ceaf4dc708

SHA512
f9040b13e55547627a495d51832ddc43c76dbc3467df27541992f874375499bb083b594e9f58fcafc5083943c325805fd3ec7331fd6df25dfce41c554543081c

Download Submit