b9cae0739fc6daee051551b3e1dfabd39db41c2996f3a905254a71def555ba36

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f039af1a66a3a9d97e5a98931ecadfa8190980e54a6b78f09df47faa4615d91.exe
Size

7.9MB
MD5

da1364870c95f396ea84ac60afdab146
SHA1

d5e023d34954e0d7e32575cf79049a7c64688456
SHA256

5f039af1a66a3a9d97e5a98931ecadfa8190980e54a6b78f09df47faa4615d91
SHA512

b6a8827705fda917b0ef6297d37979799f7ca29e9236381b57a7f6bd95b7ede836efa8056851f260706796caf3d6b6d910326fbee209aa85ab5986bdb2f9d536
SSDEEP

196608:M9sGLbd7rEWWn87E3QeotSqrG8YqcIXcZZB2:MmqbhrEbn87eZsFmq+6

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2148	R4WZ7.exe

Executes dropped EXE 2 IoCs

pid	Process
2148	R4WZ7.exe
1244	Process not Found

Loads dropped DLL 3 IoCs

pid	Process
2960	5f039af1a66a3a9d97e5a98931ecadfa8190980e54a6b78f09df47faa4615d91.exe
2960	5f039af1a66a3a9d97e5a98931ecadfa8190980e54a6b78f09df47faa4615d91.exe
1244	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2960	5f039af1a66a3a9d97e5a98931ecadfa8190980e54a6b78f09df47faa4615d91.exe
2960	5f039af1a66a3a9d97e5a98931ecadfa8190980e54a6b78f09df47faa4615d91.exe
2960	5f039af1a66a3a9d97e5a98931ecadfa8190980e54a6b78f09df47faa4615d91.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe
2148	R4WZ7.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	5f039af1a66a3a9d97e5a98931ecadfa8190980e54a6b78f09df47faa4615d91.exe
Token: SeDebugPrivilege	2148	R4WZ7.exe
Token: SeDebugPrivilege	2148	R4WZ7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2148	2960	5f039af1a66a3a9d97e5a98931ecadfa8190980e54a6b78f09df47faa4615d91.exe	31
PID 2960 wrote to memory of 2148	2960	5f039af1a66a3a9d97e5a98931ecadfa8190980e54a6b78f09df47faa4615d91.exe	31
PID 2960 wrote to memory of 2148	2960	5f039af1a66a3a9d97e5a98931ecadfa8190980e54a6b78f09df47faa4615d91.exe	31

C:\Users\Admin\AppData\Local\Temp\5f039af1a66a3a9d97e5a98931ecadfa8190980e54a6b78f09df47faa4615d91.exe
"C:\Users\Admin\AppData\Local\Temp\5f039af1a66a3a9d97e5a98931ecadfa8190980e54a6b78f09df47faa4615d91.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\R4WZ7.exe
  QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDVmMDM5YWYxYTY2YTNhOWQ5N2U1YTk4OTMxZWNhZGZhODE5MDk4MGU1NGE2Yjc4ZjA5ZGY0N2ZhYTQ2MTVkOTEuZXhl 23
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\R4WZ7.exe

Filesize
7.9MB

MD5
49dd86c0ea4b6f88bdd1cbc9fb7e9180

SHA1
9b47e012017e5f0ab1c2e111e20be6a9fff436f0

SHA256
7054b7a695ee9f8f0884568522b151618ee8b80378e62e7fdecd63465d4077e7

SHA512
664d48c3a7513d3c12b8f65352efa68b84d0b27573909c59792fec18ad3e442dd987e9f3905e0dcb054c21c78567ea366b1df4d2136615b984a448b1b7b9811a

Download Submit
memory/2148-33-0x0000000021F10000-0x0000000022996000-memory.dmp

Filesize
10.5MB

Download
memory/2148-26-0x0000000021F10000-0x0000000022996000-memory.dmp

Filesize
10.5MB

Download
memory/2148-39-0x00000000006C0000-0x00000000006CA000-memory.dmp

Filesize
40KB

Download
memory/2148-22-0x00000000006C0000-0x00000000006D0000-memory.dmp

Filesize
64KB

Download
memory/2148-38-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/2148-18-0x000000013F900000-0x0000000140C12000-memory.dmp

Filesize
19.1MB

Download
memory/2148-19-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/2148-21-0x00000000006C0000-0x00000000006CA000-memory.dmp

Filesize
40KB

Download
memory/2148-37-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/2148-20-0x00000000006C0000-0x00000000006CA000-memory.dmp

Filesize
40KB

Download
memory/2148-17-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/2148-28-0x0000000077D10000-0x0000000077D12000-memory.dmp

Filesize
8KB

Download
memory/2148-30-0x0000000077D10000-0x0000000077D12000-memory.dmp

Filesize
8KB

Download
memory/2148-32-0x0000000077D10000-0x0000000077D12000-memory.dmp

Filesize
8KB

Download
memory/2148-35-0x0000000021F10000-0x0000000022996000-memory.dmp

Filesize
10.5MB

Download
memory/2960-0-0x000007FEF5FA3000-0x000007FEF5FA4000-memory.dmp

Filesize
4KB

Download
memory/2960-2-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/2960-16-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/2960-1-0x000000013F2C0000-0x00000001405D2000-memory.dmp

Filesize
19.1MB

Download