5e807de88a43edb7b341ed17b4e218f35c3204bf5dc969c131792b0a23e9ddc1

Submit
Reports

Overview

overview

Static

static

e1dcb9ba72...29.exe

windows7-x64

e1dcb9ba72...29.exe

windows10-2004-x64

e2071b429e...5c.exe

windows7-x64

e2071b429e...5c.exe

windows10-2004-x64

e249dbf0ac...f4.exe

windows7-x64

e249dbf0ac...f4.exe

windows10-2004-x64

e277271cc7...e8.exe

windows7-x64

e277271cc7...e8.exe

windows10-2004-x64

e282def0d2...89.exe

windows7-x64

e282def0d2...89.exe

windows10-2004-x64

e29645b977...39.exe

windows7-x64

e29645b977...39.exe

windows10-2004-x64

e2bfb9c5da...0c.exe

windows7-x64

e2bfb9c5da...0c.exe

windows10-2004-x64

e316eea789...fa.exe

windows7-x64

e316eea789...fa.exe

windows10-2004-x64

e3250ba3e9...f9.exe

windows7-x64

e3250ba3e9...f9.exe

windows10-2004-x64

e34a914ca2...b1.exe

windows7-x64

e34a914ca2...b1.exe

windows10-2004-x64

e37b2913aa...c6.exe

windows7-x64

e37b2913aa...c6.exe

windows10-2004-x64

e37c63b72b...0d.exe

windows7-x64

e37c63b72b...0d.exe

windows10-2004-x64

e37cf80804...e0.exe

windows7-x64

e37cf80804...e0.exe

windows10-2004-x64

e3a2f6c598...82.exe

windows7-x64

e3a2f6c598...82.exe

windows10-2004-x64

e3a86fc42d...62.exe

windows7-x64

e3a86fc42d...62.exe

windows10-2004-x64

e3e3053d34...10.exe

windows7-x64

e3e3053d34...10.exe

windows10-2004-x64

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL

Twitter E-mail

Static task

static1

8 signatures

Behavioral task

behavioral1

Sample

e1dcb9ba72b5d530a7025537eed091187313975f51f1a4756d379129a1eaa629.exe

Resource

win7-20240903-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

e1dcb9ba72b5d530a7025537eed091187313975f51f1a4756d379129a1eaa629.exe

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

e2071b429ed0a109ba6ae98cc6bd94651c73805963058322d9ab5fc3ad8c385c.exe

Resource

win7-20240903-en

defense_evasion execution trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral4

Sample

e2071b429ed0a109ba6ae98cc6bd94651c73805963058322d9ab5fc3ad8c385c.exe

Resource

win10v2004-20250314-en

defense_evasion execution trojan

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral5

Sample

e249dbf0acda03b41cc7ffb9d3ffe996eb648e79ec5b514d819180faebef48f4.exe

Resource

win7-20241010-en

discovery

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral6

Sample

e249dbf0acda03b41cc7ffb9d3ffe996eb648e79ec5b514d819180faebef48f4.exe

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral7

Sample

e277271cc70bc12cb5a62950728025e8.exe

Resource

win7-20250207-en

dcrat defense_evasion execution infostealer rat trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral8

Sample

e277271cc70bc12cb5a62950728025e8.exe

Resource

win10v2004-20250314-en

dcrat defense_evasion execution infostealer rat trojan

windows10-2004-x64

19 signatures

150 seconds

Behavioral task

behavioral9

Sample

e282def0d26b0a0ace50c80bd0d3e389.exe

Resource

win7-20241010-en

dcrat defense_evasion execution infostealer persistence rat trojan

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral10

Sample

e282def0d26b0a0ace50c80bd0d3e389.exe

Resource

win10v2004-20250314-en

dcrat defense_evasion execution infostealer persistence rat trojan

windows10-2004-x64

22 signatures

150 seconds

Behavioral task

behavioral11

Sample

e29645b97716a1a1d083e644500c71a7e2a3c20f8c6812785f6242461eccfe39.exe

Resource

win7-20240903-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral12

Sample

e29645b97716a1a1d083e644500c71a7e2a3c20f8c6812785f6242461eccfe39.exe

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral13

Sample

e2bfb9c5dab6674c2bd9eec1f66e4f0c.exe

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

e2bfb9c5dab6674c2bd9eec1f66e4f0c.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

e316eea78900620a3194bc604bab1d058ec60832baa6df78d0795ebee9ecd6fa.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

e316eea78900620a3194bc604bab1d058ec60832baa6df78d0795ebee9ecd6fa.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

e3250ba3e962ddf90560e00c92659cf9.exe

Resource

win7-20240903-en

njrat discovery trojan

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral18

Sample

e3250ba3e962ddf90560e00c92659cf9.exe

Resource

win10v2004-20250314-en

njrat discovery trojan

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral19

Sample

e34a914ca2b4fd7d490bd7fa0893c9b1.exe

Resource

win7-20240903-en

defense_evasion discovery persistence spyware stealer

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral20

Sample

e34a914ca2b4fd7d490bd7fa0893c9b1.exe

Resource

win10v2004-20250314-en

defense_evasion discovery persistence spyware stealer

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral21

Sample

e37b2913aafb08ae275e16364b9916c6.exe

Resource

win7-20241023-en

asyncrat default discovery rat

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral22

Sample

e37b2913aafb08ae275e16364b9916c6.exe

Resource

win10v2004-20250314-en

asyncrat default discovery rat

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral23

Sample

e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe

Resource

win7-20241010-en

defense_evasion execution trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral24

Sample

e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe

Resource

win10v2004-20250314-en

defense_evasion execution trojan

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral25

Sample

e37cf808045aeb5b8ffe33d0e6a47444ac10956adad4d307c948a20dd8e53de0.exe

Resource

win7-20240903-en

credential_access persistence privilege_escalation spyware stealer

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral26

Sample

e37cf808045aeb5b8ffe33d0e6a47444ac10956adad4d307c948a20dd8e53de0.exe

Resource

win10v2004-20250314-en

credential_access persistence privilege_escalation spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral27

Sample

e3a2f6c598bc05769da36673f1f02c90f737d5293bf16ba0c839e92cf4258382.exe

Resource

win7-20241023-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

e3a2f6c598bc05769da36673f1f02c90f737d5293bf16ba0c839e92cf4258382.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral29

Sample

e3a86fc42dbea243f01ab5183b1e1f0c1907b4b6d46428df1d055ceb3dc9f662.exe

Resource

win7-20250207-en

defense_evasion discovery

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral30

Sample

e3a86fc42dbea243f01ab5183b1e1f0c1907b4b6d46428df1d055ceb3dc9f662.exe

Resource

win10v2004-20250314-en

defense_evasion discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral31

Sample

e3e3053d342cd6eb6834eca2d1c506b65d8e459b4e336fcee977e17f3fb6a910.exe

Resource

win7-20241010-en

salatstealer stealer upx

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral32

Sample

e3e3053d342cd6eb6834eca2d1c506b65d8e459b4e336fcee977e17f3fb6a910.exe

Resource

win10v2004-20250314-en

salatstealer credential_access discovery spyware stealer upx

windows10-2004-x64

17 signatures

150 seconds

Report Analysis Logs

General

Target

e2bfb9c5dab6674c2bd9eec1f66e4f0c.exe
Size

83KB
MD5

e2bfb9c5dab6674c2bd9eec1f66e4f0c
SHA1

1ded7a38ee2a1401ba39a7b2641aa53cb1c85355
SHA256

2dfe346587d3bcc2dfb437c3fca97fbb38d2ad6aebbae862e96ff8c4e78f1d28
SHA512

0b4990bd6277222a10ba62bd208fe08e5553566b2b765a5f32035c72454dd7b024aced533f28e0eb869e5699f8d53f591d174828f59c7ddab68f3eee37918fd1
SSDEEP

1536:M/u1tcHm/adpsWxW3I095NRAX5EP1TSqtH14WhrftbIRT8QTN7jZ4dgRnF7boo1K:MW1tcHm/adpsWxW3I095NRAX5EP1TSqF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2292	2428	e2bfb9c5dab6674c2bd9eec1f66e4f0c.exe	31
PID 2428 wrote to memory of 2292	2428	e2bfb9c5dab6674c2bd9eec1f66e4f0c.exe	31
PID 2428 wrote to memory of 2292	2428	e2bfb9c5dab6674c2bd9eec1f66e4f0c.exe	31

Processes

C:\Users\Admin\AppData\Local\Temp\e2bfb9c5dab6674c2bd9eec1f66e4f0c.exe
"C:\Users\Admin\AppData\Local\Temp\e2bfb9c5dab6674c2bd9eec1f66e4f0c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2428 -s 508
  2⤵
  PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-0-0x000007FEF6263000-0x000007FEF6264000-memory.dmp

Filesize
4KB

Download
memory/2428-1-0x0000000000D30000-0x0000000000D4C000-memory.dmp

Filesize
112KB

Download