Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/11/2024, 21:05
Behavioral task
behavioral1
Sample
free hecks.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
free hecks.exe
Resource
win10v2004-20241007-en
General
-
Target
free hecks.exe
-
Size
20.2MB
-
MD5
53b134826d5c036f87e2acc22b10b159
-
SHA1
50c698af25e92c46d78e04519454389fca9795fb
-
SHA256
0e414694d08123f2f0639603ff0f3c8105554653d393a20d42b295cc74882244
-
SHA512
bbfc7ee8e65fe2209b0f4186c5eb1309940b804694e746f96bcfa050bc41654e14b727923d934b459676d2cfe4747b3f2c9ab4ec3cef005f4ccbbf1a7e154c3b
-
SSDEEP
393216:q2L7Y1RtByxjXBYFzLNHyZOOOOOOOOOOOOOn3F7nSGt7G/8MQc/jTiNV2ZgZdZnL:UtAj2PyUln+PQajEV2Z23F
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 2080 free hecks.exe 2080 free hecks.exe 2080 free hecks.exe 2080 free hecks.exe 2080 free hecks.exe 2080 free hecks.exe 2080 free hecks.exe -
resource yara_rule behavioral1/files/0x000500000001c8ec-168.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2080 2344 free hecks.exe 31 PID 2344 wrote to memory of 2080 2344 free hecks.exe 31 PID 2344 wrote to memory of 2080 2344 free hecks.exe 31
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD54a060eec454c222a5381cd359dc00b81
SHA121e1bc115d04a74779e955ea16a16bd71454d9bb
SHA256e6b2b05e14a6c6f5381e8f4c7f4fd28a499246fb4c8eafe1f08014b9273d70df
SHA51216fb1f4ccdad05d07feb62e0cd078401f4023f9fab0fb15e52b927ca413e65eb32c2932ba59dbfa7f7ee0e8a8053748e27f2757e82e600db812271aa44a9433c
-
Filesize
20KB
MD550abf0a7ee67f00f247bada185a7661c
SHA10cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA256f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
SHA512c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
-
Filesize
21KB
MD54c26932f8f1f490017add31f5ec0a533
SHA10da01a7c89b506fe3fd939344bb51b976efb3207
SHA256dd3843c2e46b4e926c36150d614efe02ca0ebc1f767f64f471568adc35c2ef23
SHA512eb2b87d187991fdc8e3a6577f20622d2d4a2a994dd375d8c27e1434ce786596533eacfbde8714db9959d88d6bcb91fdc8079c60c23f0eb920ba45c546a44e523
-
Filesize
21KB
MD5a6776c201baae1dd6f88048d7747d14c
SHA1646119d2e440e6dad0ffb0fe449ab4fc27f09fbe
SHA256ee99af71c347ff53c4e15109cb597759e657a3e859d9530680eeea8bb0540112
SHA512a9137af8529fd96dbba22c5179a16d112ec0bfab9792babe0a9f1cca27408eff73ba89f498cb5f941a5aa44555529ee10484e6ca4a3fbf1627523acfde622b45
-
Filesize
21KB
MD510d466341e7ece8cf75b5d026105741b
SHA131d1e9b9a4511156695b5aa33d65b6a36f8139c2
SHA2565ce391edb33c7055e724a4c3cecc64d16ba2aa4724cb99cd5aed00b0cecfbc82
SHA5128778fd10c7360bd87db048a2b2ca6603455fd8cb4d0e18709f106b55db7cc92e7d6dc45385ff9def445b368376462e7d253442728d5e759faa97299b67a59e21
-
Filesize
1.4MB
MD5b93eda8cc111a5bde906505224b717c3
SHA15f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e
SHA256efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983
SHA512b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba
-
Filesize
1.1MB
MD53b337c2d41069b0a1e43e30f891c3813
SHA1ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499