Resubmissions
12-11-2024 01:29
241112-bwgrxs1gnf 1008-07-2021 12:18
210708-8z6d5h8z2n 1006-07-2021 17:53
210706-g6we6sa7sa 1019-06-2021 18:17
210619-vr8bj2dzfn 1017-06-2021 21:39
210617-a9cvlnmrbx 1011-06-2021 17:26
210611-wvab1yw2tj 1008-06-2021 06:47
210608-qrbpch3y46 1008-06-2021 06:47
210608-64tndgm1ln 1005-06-2021 18:40
210605-cd6qpr55sx 1004-06-2021 11:56
210604-5c416rs3ns 10Analysis
-
max time kernel
1577s -
max time network
1572s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
04-05-2021 15:44
General
-
Target
Install.exe
-
Size
497KB
-
MD5
41a5f4fd1ea7cac4aa94a87aebccfef0
-
SHA1
0d0abf079413a4c773754bf4fda338dc5b9a8ddc
-
SHA256
97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9
-
SHA512
5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-S1CE2.tmp\Install.tmp"C:\Users\Admin\AppData\Local\Temp\is-S1CE2.tmp\Install.tmp" /SL5="$2015C,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-COD2B.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-COD2B.tmp\Ultra.exe" /S /UID=burnerch13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 8924⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
172KB
-
Filesize
4KB