Analysis

  • max time kernel
    30s
  • max time network
    34s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    23-05-2021 17:01

General

  • Target

    27118A12FE3AAAC9FC76624CEB4EC722.exe

  • Size

    380KB

  • MD5

    27118a12fe3aaac9fc76624ceb4ec722

  • SHA1

    912c07ea3c0f3399c9c0b87524b763e11f50d322

  • SHA256

    aa9be79c40da851c806a4cbd196aad2731e57090c5c4e0bb107437073e0ebd11

  • SHA512

    e36f5d14af85bfcb40c5793c919ae8755dbacef27f619be67ce7cd87f588e3c7ad96a9ac9c667c4caeeae244c7127b2198939a42742fe88c03dbb318e2dd0202

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27118A12FE3AAAC9FC76624CEB4EC722.exe
    "C:\Users\Admin\AppData\Local\Temp\27118A12FE3AAAC9FC76624CEB4EC722.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:740
    • C:\Users\Admin\AppData\Local\Temp\is-HTCJT.tmp\27118A12FE3AAAC9FC76624CEB4EC722.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-HTCJT.tmp\27118A12FE3AAAC9FC76624CEB4EC722.tmp" /SL5="$8005A,140559,56832,C:\Users\Admin\AppData\Local\Temp\27118A12FE3AAAC9FC76624CEB4EC722.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-HTCJT.tmp\27118A12FE3AAAC9FC76624CEB4EC722.tmp

    MD5

    ffcf263a020aa7794015af0edee5df0b

    SHA1

    bce1eb5f0efb2c83f416b1782ea07c776666fdab

    SHA256

    1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

    SHA512

    49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

  • \Users\Admin\AppData\Local\Temp\is-K97KP.tmp\idp.dll

    MD5

    8f995688085bced38ba7795f60a5e1d3

    SHA1

    5b1ad67a149c05c50d6e388527af5c8a0af4343a

    SHA256

    203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

    SHA512

    043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

  • memory/740-114-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3176-115-0x0000000000000000-mapping.dmp

  • memory/3176-118-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB