5307ce2390d7c4bfba56c3f519dfcf29d7a5e1752150847c43b6d94d5a9e0ffb

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91e6d47bd804e58a4e160993dfdfc3cc.exe
Size

7.9MB
MD5

91e6d47bd804e58a4e160993dfdfc3cc
SHA1

c273d38db777c882addc54c595e392b587aaa980
SHA256

7480338642edf06769bc62a28e084eb5cd9487868f95543337ebe8a9c32c7093
SHA512

ae0663df09766e33194f844d101f072ecf8af8af4081897256dea24bbce1b3ff38473dbf80d23e7eaf74930f0d42a6b45a80930425cbd43e3e8daade219a2a62
SSDEEP

196608:G9sGLbd7rEWWn87E3QeotSqrG8YqcIXcZZB2:GmqbhrEbn87eZsFmq+6

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2656	G7tE4.exe

Executes dropped EXE 2 IoCs

pid	Process
2656	G7tE4.exe
1180	Process not Found

Loads dropped DLL 3 IoCs

pid	Process
2772	91e6d47bd804e58a4e160993dfdfc3cc.exe
2772	91e6d47bd804e58a4e160993dfdfc3cc.exe
1180	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2772	91e6d47bd804e58a4e160993dfdfc3cc.exe
2772	91e6d47bd804e58a4e160993dfdfc3cc.exe
2772	91e6d47bd804e58a4e160993dfdfc3cc.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe
2656	G7tE4.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	91e6d47bd804e58a4e160993dfdfc3cc.exe
Token: SeDebugPrivilege	2656	G7tE4.exe
Token: SeDebugPrivilege	2656	G7tE4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2656	2772	91e6d47bd804e58a4e160993dfdfc3cc.exe	31
PID 2772 wrote to memory of 2656	2772	91e6d47bd804e58a4e160993dfdfc3cc.exe	31
PID 2772 wrote to memory of 2656	2772	91e6d47bd804e58a4e160993dfdfc3cc.exe	31

C:\Users\Admin\AppData\Local\Temp\91e6d47bd804e58a4e160993dfdfc3cc.exe
"C:\Users\Admin\AppData\Local\Temp\91e6d47bd804e58a4e160993dfdfc3cc.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\G7tE4.exe
  QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDkxZTZkNDdiZDgwNGU1OGE0ZTE2MDk5M2RmZGZjM2NjLmV4ZQ== 25
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\G7tE4.exe

Filesize
7.9MB

MD5
1424501540f057cc91a20f2e0cd039fc

SHA1
a2c6a68d51222e625dce43a5240688f1df30e16c

SHA256
55fd427d1a2a56f6c14bbc9c6e7037ce6523448f09e9b647dd4e75d7cc3220a3

SHA512
feaf4f992c129ae9d5ed7da04c53c364819fe3541f6149d33ba37d6ffe1d9e612844f2dfdfe57b1163b421b38bdd6f18dadb0b3afc7ad532d5f94d45e3e05062

Download Submit
memory/2656-22-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/2656-26-0x0000000022390000-0x0000000022E16000-memory.dmp

Filesize
10.5MB

Download
memory/2656-39-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/2656-38-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

Filesize
9.9MB

Download
memory/2656-37-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

Filesize
9.9MB

Download
memory/2656-18-0x000000013F990000-0x0000000140CA2000-memory.dmp

Filesize
19.1MB

Download
memory/2656-19-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

Filesize
9.9MB

Download
memory/2656-21-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/2656-33-0x0000000022390000-0x0000000022E16000-memory.dmp

Filesize
10.5MB

Download
memory/2656-20-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/2656-17-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

Filesize
9.9MB

Download
memory/2656-30-0x0000000076EF0000-0x0000000076EF2000-memory.dmp

Filesize
8KB

Download
memory/2656-32-0x0000000076EF0000-0x0000000076EF2000-memory.dmp

Filesize
8KB

Download
memory/2656-28-0x0000000076EF0000-0x0000000076EF2000-memory.dmp

Filesize
8KB

Download
memory/2656-35-0x0000000022390000-0x0000000022E16000-memory.dmp

Filesize
10.5MB

Download
memory/2772-2-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

Filesize
9.9MB

Download
memory/2772-1-0x000000013FB10000-0x0000000140E22000-memory.dmp

Filesize
19.1MB

Download
memory/2772-0-0x000007FEF58C3000-0x000007FEF58C4000-memory.dmp

Filesize
4KB

Download
memory/2772-16-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

Filesize
9.9MB

Download