70bba6e748b04c937188f113389a3c90bf30806add70222b920886a57b0bdd98

Analysis

max time kernel
148s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12199d72af0652fdf09349f59304d485.exe
Size

7.9MB
MD5

12199d72af0652fdf09349f59304d485
SHA1

b4d0ce7b6f4f014bbc1235b5c26d2f8304328618
SHA256

07bc2ca1348f662330734e4de3996566587cd7db17fdb137e35c645a872257c0
SHA512

990365aa82b820de02e80ff295bc50b5e1dd57615e906cc485b715baa9df89010034feff825f86bcb046de6d326a6bad26e9cee300fc7e7ea41239f379f6f21d
SSDEEP

196608:i9sGLbd7rEWWn87E3QeotSqrG8YqcIXcZZBy:imqbhrEbn87eZsFmq+m

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2484	9gc2M.exe

Executes dropped EXE 2 IoCs

pid	Process
2484	9gc2M.exe
1196	Process not Found

Loads dropped DLL 3 IoCs

pid	Process
1788	12199d72af0652fdf09349f59304d485.exe
1788	12199d72af0652fdf09349f59304d485.exe
1196	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1788	12199d72af0652fdf09349f59304d485.exe
1788	12199d72af0652fdf09349f59304d485.exe
1788	12199d72af0652fdf09349f59304d485.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe
2484	9gc2M.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	12199d72af0652fdf09349f59304d485.exe
Token: SeDebugPrivilege	2484	9gc2M.exe
Token: SeDebugPrivilege	2484	9gc2M.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2484	1788	12199d72af0652fdf09349f59304d485.exe	30
PID 1788 wrote to memory of 2484	1788	12199d72af0652fdf09349f59304d485.exe	30
PID 1788 wrote to memory of 2484	1788	12199d72af0652fdf09349f59304d485.exe	30

C:\Users\Admin\AppData\Local\Temp\12199d72af0652fdf09349f59304d485.exe
"C:\Users\Admin\AppData\Local\Temp\12199d72af0652fdf09349f59304d485.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\9gc2M.exe
  QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDEyMTk5ZDcyYWYwNjUyZmRmMDkzNDlmNTkzMDRkNDg1LmV4ZQ== 25
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9gc2M.exe

Filesize
7.9MB

MD5
024e8fbb496b1452e6c0c187f1f864a1

SHA1
3f7a558da11cb08d1f66474f33dd9625099bc49b

SHA256
5ed2244f9806f305ac802526636732961ff5b4c273159620c04f1b80766e52e9

SHA512
4b837f876c86172dd496e93a16959847b59d4ad3159eadb91f1711c6f63505abbe4f6495722d13973fcd3b6107c73fd4610f5a9b781904a57dae80a06dbf4de5

Download Submit
memory/1788-16-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/1788-1-0x000000013FB50000-0x0000000140E62000-memory.dmp

Filesize
19.1MB

Download
memory/1788-2-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/1788-0-0x000007FEF5D13000-0x000007FEF5D14000-memory.dmp

Filesize
4KB

Download
memory/2484-22-0x0000000000870000-0x0000000000880000-memory.dmp

Filesize
64KB

Download
memory/2484-35-0x00000000218F0000-0x0000000022376000-memory.dmp

Filesize
10.5MB

Download
memory/2484-19-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/2484-21-0x0000000000870000-0x000000000087A000-memory.dmp

Filesize
40KB

Download
memory/2484-20-0x0000000000870000-0x000000000087A000-memory.dmp

Filesize
40KB

Download
memory/2484-17-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/2484-26-0x00000000218F0000-0x0000000022376000-memory.dmp

Filesize
10.5MB

Download
memory/2484-18-0x000000013F660000-0x0000000140972000-memory.dmp

Filesize
19.1MB

Download
memory/2484-32-0x0000000077B50000-0x0000000077B52000-memory.dmp

Filesize
8KB

Download
memory/2484-33-0x00000000218F0000-0x0000000022376000-memory.dmp

Filesize
10.5MB

Download
memory/2484-30-0x0000000077B50000-0x0000000077B52000-memory.dmp

Filesize
8KB

Download
memory/2484-28-0x0000000077B50000-0x0000000077B52000-memory.dmp

Filesize
8KB

Download
memory/2484-37-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/2484-38-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/2484-39-0x0000000000870000-0x000000000087A000-memory.dmp

Filesize
40KB

Download