7ddbec7fac00ec5624f45da5879ebfa97d95b21c7842cbaa1058daa46a47bd41

Analysis

max time kernel
58s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3a61d282c9a5249427d1c50d79414b05441de100982cf90354b0466ec013e2f.exe
Size

7.9MB
MD5

f9ccfba03895eb7877510ace1bf59a71
SHA1

87a165c002005a72324064922faf48c55ed809b6
SHA256

c3a61d282c9a5249427d1c50d79414b05441de100982cf90354b0466ec013e2f
SHA512

b61f17eb86b5d79e228100228f785703cc1582867b5be13b0ceda0bbe4329e2ccb31981365d0edd428e34c9db5f40bc5bc9faa54c52043f5c0983ae288ae8e47
SSDEEP

196608:c9sGLbd7rEWWn87E3QeotSqrG8YqcIXcZZBy:cmqbhrEbn87eZsFmq+m

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2692	g6DLPD.exe

Executes dropped EXE 2 IoCs

pid	Process
2692	g6DLPD.exe
1200	Process not Found

Loads dropped DLL 2 IoCs

pid	Process
2764	c3a61d282c9a5249427d1c50d79414b05441de100982cf90354b0466ec013e2f.exe
2764	c3a61d282c9a5249427d1c50d79414b05441de100982cf90354b0466ec013e2f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2764	c3a61d282c9a5249427d1c50d79414b05441de100982cf90354b0466ec013e2f.exe
2764	c3a61d282c9a5249427d1c50d79414b05441de100982cf90354b0466ec013e2f.exe
2764	c3a61d282c9a5249427d1c50d79414b05441de100982cf90354b0466ec013e2f.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe
2692	g6DLPD.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	c3a61d282c9a5249427d1c50d79414b05441de100982cf90354b0466ec013e2f.exe
Token: SeDebugPrivilege	2692	g6DLPD.exe
Token: SeDebugPrivilege	2692	g6DLPD.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2692	2764	c3a61d282c9a5249427d1c50d79414b05441de100982cf90354b0466ec013e2f.exe	30
PID 2764 wrote to memory of 2692	2764	c3a61d282c9a5249427d1c50d79414b05441de100982cf90354b0466ec013e2f.exe	30
PID 2764 wrote to memory of 2692	2764	c3a61d282c9a5249427d1c50d79414b05441de100982cf90354b0466ec013e2f.exe	30

C:\Users\Admin\AppData\Local\Temp\c3a61d282c9a5249427d1c50d79414b05441de100982cf90354b0466ec013e2f.exe
"C:\Users\Admin\AppData\Local\Temp\c3a61d282c9a5249427d1c50d79414b05441de100982cf90354b0466ec013e2f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Local\Temp\g6DLPD.exe
  QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXGMzYTYxZDI4MmM5YTUyNDk0MjdkMWM1MGQ3OTQxNGIwNTQ0MWRlMTAwOTgyY2Y5MDM1NGIwNDY2ZWMwMTNlMmYuZXhl 11
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\g6DLPD.exe

Filesize
7.9MB

MD5
25d69f181bc26ae273ea90cd9ffb64dd

SHA1
df9e8e7ddeb1210c6fa4b241925b7b950c99269f

SHA256
a74bcc08b41a4975fdb1a0a3e301fab0246a63b145d75039abd43de1878a85c5

SHA512
0120fee8338edb7632a33e2b2877792523b45823043e8d2caf8e12ef10a3173f091902613a0b4988e1c326878f583b2accd80271122aba06c13bb03e2eb638d6

Download Submit
memory/2692-22-0x0000000000650000-0x0000000000660000-memory.dmp

Filesize
64KB

Download
memory/2692-25-0x0000000021DA0000-0x0000000022826000-memory.dmp

Filesize
10.5MB

Download
memory/2692-38-0x0000000000650000-0x000000000065A000-memory.dmp

Filesize
40KB

Download
memory/2692-37-0x000007FEF5FF0000-0x000007FEF69DC000-memory.dmp

Filesize
9.9MB

Download
memory/2692-17-0x000007FEF5FF0000-0x000007FEF69DC000-memory.dmp

Filesize
9.9MB

Download
memory/2692-18-0x000000013FB30000-0x0000000140E42000-memory.dmp

Filesize
19.1MB

Download
memory/2692-19-0x000007FEF5FF0000-0x000007FEF69DC000-memory.dmp

Filesize
9.9MB

Download
memory/2692-20-0x0000000000650000-0x000000000065A000-memory.dmp

Filesize
40KB

Download
memory/2692-36-0x000007FEF5FF0000-0x000007FEF69DC000-memory.dmp

Filesize
9.9MB

Download
memory/2692-21-0x0000000000650000-0x000000000065A000-memory.dmp

Filesize
40KB

Download
memory/2692-27-0x0000000077A90000-0x0000000077A92000-memory.dmp

Filesize
8KB

Download
memory/2692-31-0x0000000077A90000-0x0000000077A92000-memory.dmp

Filesize
8KB

Download
memory/2692-29-0x0000000077A90000-0x0000000077A92000-memory.dmp

Filesize
8KB

Download
memory/2692-33-0x0000000021DA0000-0x0000000022826000-memory.dmp

Filesize
10.5MB

Download
memory/2692-34-0x0000000021DA0000-0x0000000022826000-memory.dmp

Filesize
10.5MB

Download
memory/2764-16-0x000007FEF5FF0000-0x000007FEF69DC000-memory.dmp

Filesize
9.9MB

Download
memory/2764-2-0x000007FEF5FF0000-0x000007FEF69DC000-memory.dmp

Filesize
9.9MB

Download
memory/2764-0-0x000007FEF5FF3000-0x000007FEF5FF4000-memory.dmp

Filesize
4KB

Download
memory/2764-1-0x000000013F310000-0x0000000140622000-memory.dmp

Filesize
19.1MB

Download