Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-11-2020 17:57
General
-
Target
fd5f96d463acd6c0db1f3b3de2fd4bb00c823e25a45de3284cd7ed5a97f4cf2e.exe
-
Size
1.4MB
-
MD5
dced196a0e7c959dfcd2a43b9790d564
-
SHA1
1a2a9ae4a3293276fa7e21f6c1d2ae0288dec6ae
-
SHA256
fd5f96d463acd6c0db1f3b3de2fd4bb00c823e25a45de3284cd7ed5a97f4cf2e
-
SHA512
895ad9c75b21ff223d802992c11acfc3948cc84f097adc6eea7439c7ec5b68b392adc7eaa5ee397144e507666e3bdfbbeffaa0f875f40fe7b35947931009f584
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 36 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd5f96d463acd6c0db1f3b3de2fd4bb00c823e25a45de3284cd7ed5a97f4cf2e.exe"C:\Users\Admin\AppData\Local\Temp\fd5f96d463acd6c0db1f3b3de2fd4bb00c823e25a45de3284cd7ed5a97f4cf2e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-UG5TQ.tmp\fd5f96d463acd6c0db1f3b3de2fd4bb00c823e25a45de3284cd7ed5a97f4cf2e.tmp"C:\Users\Admin\AppData\Local\Temp\is-UG5TQ.tmp\fd5f96d463acd6c0db1f3b3de2fd4bb00c823e25a45de3284cd7ed5a97f4cf2e.tmp" /SL5="$2010E,1267582,56320,C:\Users\Admin\AppData\Local\Temp\fd5f96d463acd6c0db1f3b3de2fd4bb00c823e25a45de3284cd7ed5a97f4cf2e.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\vmSongs\5.0.0.2\vlsongs.exe"C:\Program Files (x86)\vmSongs\5.0.0.2\vlsongs.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\vmSongs\5.0.0.2\vlsongs.exeMD5
22fc29c786ac565d520c36bc41a98294
SHA1cb85d118eda159da8982f556df3a55b0c9732cce
SHA256588b6d0666bcd5ec353297230a24fbdf5c37fd8505e50339d0c8fec4bf8c28b9
SHA512df6f2d9eff7142ceadf620395e9f3d79e9ab37c91c3f6ebbae753d75a1963f8bace8df44b4e206c97b7873cdf8d5797d0c82e9abaf83f7e473af514acac1b09f
-
C:\Program Files (x86)\vmSongs\5.0.0.2\vlsongs.exeMD5
22fc29c786ac565d520c36bc41a98294
SHA1cb85d118eda159da8982f556df3a55b0c9732cce
SHA256588b6d0666bcd5ec353297230a24fbdf5c37fd8505e50339d0c8fec4bf8c28b9
SHA512df6f2d9eff7142ceadf620395e9f3d79e9ab37c91c3f6ebbae753d75a1963f8bace8df44b4e206c97b7873cdf8d5797d0c82e9abaf83f7e473af514acac1b09f
-
C:\Users\Admin\AppData\Local\Temp\is-UG5TQ.tmp\fd5f96d463acd6c0db1f3b3de2fd4bb00c823e25a45de3284cd7ed5a97f4cf2e.tmpMD5
59ab2369451dd76b21f6689021538902
SHA14682a9adebc54745f371476216ed9f41e27d373b
SHA25606d6198366f36d347188e968eeb31d0b0c171c913422d7ded9bb0b14ae3c073c
SHA512feb53f203f988ca517ad438d086c8ce236bb33dfa005d2558c5ca2f9647849261497762f4bc3eb8a73ede38d3bc4c2c5efeaad03fe810137778e9fe0c88a8a0b
-
C:\Users\Admin\AppData\Local\Temp\is-UG5TQ.tmp\fd5f96d463acd6c0db1f3b3de2fd4bb00c823e25a45de3284cd7ed5a97f4cf2e.tmpMD5
59ab2369451dd76b21f6689021538902
SHA14682a9adebc54745f371476216ed9f41e27d373b
SHA25606d6198366f36d347188e968eeb31d0b0c171c913422d7ded9bb0b14ae3c073c
SHA512feb53f203f988ca517ad438d086c8ce236bb33dfa005d2558c5ca2f9647849261497762f4bc3eb8a73ede38d3bc4c2c5efeaad03fe810137778e9fe0c88a8a0b
-
\Users\Admin\AppData\Local\Temp\is-CCVPE.tmp\_isetup\_iscrypt.dllMD5
a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
memory/508-4-0x0000000000000000-mapping.dmp
-
memory/4092-0-0x0000000000000000-mapping.dmp