f4111d30be32600233ad61440ff2f9a6484f3ba6c04fae4b522fc09ab0de3831

Submit
Reports

Overview

overview

Static

static

477abe4b25...51.exe

windows7-x64

477abe4b25...51.exe

windows10-2004-x64

47c6de91e1...b0.exe

windows7-x64

47c6de91e1...b0.exe

windows10-2004-x64

47ce70cdef...aa.exe

windows7-x64

47ce70cdef...aa.exe

windows10-2004-x64

4809a98c25...ee.exe

windows7-x64

4809a98c25...ee.exe

windows10-2004-x64

480bfd19cc...7e.exe

windows7-x64

480bfd19cc...7e.exe

windows10-2004-x64

4818942b62...ae.exe

windows7-x64

4818942b62...ae.exe

windows10-2004-x64

485ef3e4d3...15.exe

windows7-x64

485ef3e4d3...15.exe

windows10-2004-x64

486a44dd40...61.exe

windows7-x64

486a44dd40...61.exe

windows10-2004-x64

487afaa242...b4.exe

windows7-x64

487afaa242...b4.exe

windows10-2004-x64

488aec85d4...b2.exe

windows7-x64

488aec85d4...b2.exe

windows10-2004-x64

48dd84f7a2...da.exe

windows7-x64

48dd84f7a2...da.exe

windows10-2004-x64

4931b13a12...db.exe

windows7-x64

4931b13a12...db.exe

windows10-2004-x64

4963d3411f...95.exe

windows7-x64

4963d3411f...95.exe

windows10-2004-x64

4981b96b4a...e4.exe

windows7-x64

4981b96b4a...e4.exe

windows10-2004-x64

4996155e60...cb.exe

windows7-x64

4996155e60...cb.exe

windows10-2004-x64

49986bd925...30.exe

windows7-x64

49986bd925...30.exe

windows10-2004-x64

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:10

Sharing

Copy URL

Twitter E-mail

Static task

static1

7 signatures

Behavioral task

behavioral1

Sample

477abe4b25790663f42286884bad1f54fccac4fd3c881cf1c7d7ad8d7bab3351.exe

Resource

win7-20241023-en

collection credential_access discovery persistence spyware stealer

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

477abe4b25790663f42286884bad1f54fccac4fd3c881cf1c7d7ad8d7bab3351.exe

Resource

win10v2004-20250314-en

collection credential_access discovery persistence spyware stealer

windows10-2004-x64

19 signatures

150 seconds

Behavioral task

behavioral3

Sample

47c6de91e1706234f4587aa8f42a8c76d818b3055dc457b6dda51b803bf09ab0.exe

Resource

win7-20240903-en

xworm discovery rat trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral4

Sample

47c6de91e1706234f4587aa8f42a8c76d818b3055dc457b6dda51b803bf09ab0.exe

Resource

win10v2004-20250314-en

xworm discovery rat trojan

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral5

Sample

47ce70cdeffbe184e4414b64b813fcaa.exe

Resource

win7-20240903-en

defense_evasion discovery persistence

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral6

Sample

47ce70cdeffbe184e4414b64b813fcaa.exe

Resource

win10v2004-20250314-en

discovery persistence

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral7

Sample

4809a98c25f0a7be709206691dd2a0ee.exe

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

4809a98c25f0a7be709206691dd2a0ee.exe

Resource

win10v2004-20250314-en

defense_evasion evasion persistence privilege_escalation trojan

windows10-2004-x64

28 signatures

150 seconds

Behavioral task

behavioral9

Sample

480bfd19cce007d5891ad838d903b17e.exe

Resource

win7-20240903-en

dcrat infostealer persistence rat

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral10

Sample

480bfd19cce007d5891ad838d903b17e.exe

Resource

win10v2004-20250314-en

dcrat infostealer persistence rat

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral11

Sample

4818942b6268d474373eadf8aa175f0de0315fc406eafa97d7fa7db7c154e9ae.exe

Resource

win7-20241010-en

xworm rat trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral12

Sample

4818942b6268d474373eadf8aa175f0de0315fc406eafa97d7fa7db7c154e9ae.exe

Resource

win10v2004-20250314-en

xworm rat trojan

windows10-2004-x64

9 signatures

150 seconds

Behavioral task

behavioral13

Sample

485ef3e4d31b39e6107f797859f14415.exe

Resource

win7-20240729-en

dcrat defense_evasion execution infostealer rat trojan

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral14

Sample

485ef3e4d31b39e6107f797859f14415.exe

Resource

win10v2004-20250314-en

dcrat defense_evasion execution infostealer rat trojan

windows10-2004-x64

20 signatures

150 seconds

Behavioral task

behavioral15

Sample

486a44dd40852eb23aeca8e8951ffa61.exe

Resource

win7-20241010-en

njrat defense_evasion discovery execution persistence trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral16

Sample

486a44dd40852eb23aeca8e8951ffa61.exe

Resource

win10v2004-20250314-en

njrat defense_evasion discovery execution persistence trojan

windows10-2004-x64

14 signatures

150 seconds

Behavioral task

behavioral17

Sample

487afaa2421384f1449a96637df558b4.exe

Resource

win7-20240903-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral18

Sample

487afaa2421384f1449a96637df558b4.exe

Resource

win10v2004-20250313-en

discovery

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral19

Sample

488aec85d490754bc445f0e21e7d4d5146c71d500bd953b8108608d44e0351b2.exe

Resource

win7-20240903-en

defense_evasion execution spyware stealer

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral20

Sample

488aec85d490754bc445f0e21e7d4d5146c71d500bd953b8108608d44e0351b2.exe

Resource

win10v2004-20250314-en

defense_evasion execution spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral21

Sample

48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe

Resource

win7-20240729-en

dcrat defense_evasion infostealer rat trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral22

Sample

48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe

Resource

win10v2004-20250314-en

dcrat defense_evasion infostealer rat trojan

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral23

Sample

4931b13a1265c5602753b3933aeb20740855f573997799ae8aed85ca66d193db.exe

Resource

win7-20240903-en

nanocore discovery keylogger persistence spyware stealer trojan

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral24

Sample

4931b13a1265c5602753b3933aeb20740855f573997799ae8aed85ca66d193db.exe

Resource

win10v2004-20250314-en

nanocore discovery keylogger persistence spyware stealer trojan

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral25

Sample

4963d3411f742a92635dbd83146f3f5f7abed444f92750bcdd14072efd30e695.exe

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

4963d3411f742a92635dbd83146f3f5f7abed444f92750bcdd14072efd30e695.exe

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral27

Sample

4981b96b4a936aa6e960d3d9604a63e4.exe

Resource

win7-20241010-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral28

Sample

4981b96b4a936aa6e960d3d9604a63e4.exe

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral29

Sample

4996155e60aac91174cee14de1120fcb.exe

Resource

win7-20240903-en

xworm rat trojan

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral30

Sample

4996155e60aac91174cee14de1120fcb.exe

Resource

win10v2004-20250314-en

xworm rat trojan

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral31

Sample

49986bd925df8b3a09e58c4999927830.exe

Resource

win7-20240903-en

dcrat execution infostealer rat

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral32

Sample

49986bd925df8b3a09e58c4999927830.exe

Resource

win10v2004-20250314-en

dcrat execution infostealer rat

windows10-2004-x64

16 signatures

150 seconds

Report Analysis Logs

General

Target

4809a98c25f0a7be709206691dd2a0ee.exe
Size

54KB
MD5

4809a98c25f0a7be709206691dd2a0ee
SHA1

83d5c6c56b101dbbff6c7e6a9abdc77270e460a1
SHA256

92d6bd28467aeb15829e676d32c09f5981baf3845ebaf7f69da9741c372b1cda
SHA512

85147c8b32df54d542f9e510226f8874f1aa5bc03e4bdc9a195a156fd92630a7ee10b15c18068244817ed5251a5bcbe5c8b52368753a389fcda7af1deacac75b
SSDEEP

1536:FOpwLVcvsG+yiZodvTlhJX3eye5IybOCoDGbfY:F4wLyvky6opTTt33MSN6rY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2072	3056	4809a98c25f0a7be709206691dd2a0ee.exe	30
PID 3056 wrote to memory of 2072	3056	4809a98c25f0a7be709206691dd2a0ee.exe	30
PID 3056 wrote to memory of 2072	3056	4809a98c25f0a7be709206691dd2a0ee.exe	30

Processes

C:\Users\Admin\AppData\Local\Temp\4809a98c25f0a7be709206691dd2a0ee.exe
"C:\Users\Admin\AppData\Local\Temp\4809a98c25f0a7be709206691dd2a0ee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3056 -s 528
  2⤵
  PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-0-0x000007FEF5B63000-0x000007FEF5B64000-memory.dmp

Filesize
4KB

Download
memory/3056-1-0x0000000000C00000-0x0000000000C14000-memory.dmp

Filesize
80KB

Download