Analysis

  • max time kernel
    38s
  • max time network
    40s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    26-05-2021 16:56

General

  • Target

    ac7560fd5eae593bc3dd81a19f68647f.exe

  • Size

    380KB

  • MD5

    ac7560fd5eae593bc3dd81a19f68647f

  • SHA1

    e6addb41986cf296d935f60d3d61f595dbd26857

  • SHA256

    f92ea3668a35fbf6e26ba93ed3c2ee31235e41013b79cd661aa061d1327540d9

  • SHA512

    eac194e25ec730dafb1ea03378ba33ba52bc3d01be785bd24a73ffcaf05a1b8c26c624238c27d6108b32d19dd5679d80493c2582190eb2e6d604365796e270ad

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac7560fd5eae593bc3dd81a19f68647f.exe
    "C:\Users\Admin\AppData\Local\Temp\ac7560fd5eae593bc3dd81a19f68647f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Users\Admin\AppData\Local\Temp\is-PI3FM.tmp\ac7560fd5eae593bc3dd81a19f68647f.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PI3FM.tmp\ac7560fd5eae593bc3dd81a19f68647f.tmp" /SL5="$30028,140518,56832,C:\Users\Admin\AppData\Local\Temp\ac7560fd5eae593bc3dd81a19f68647f.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-PI3FM.tmp\ac7560fd5eae593bc3dd81a19f68647f.tmp

    MD5

    ffcf263a020aa7794015af0edee5df0b

    SHA1

    bce1eb5f0efb2c83f416b1782ea07c776666fdab

    SHA256

    1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

    SHA512

    49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

  • \Users\Admin\AppData\Local\Temp\is-NJBVB.tmp\_isetup\_shfoldr.dll

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-NJBVB.tmp\_isetup\_shfoldr.dll

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-NJBVB.tmp\idp.dll

    MD5

    8f995688085bced38ba7795f60a5e1d3

    SHA1

    5b1ad67a149c05c50d6e388527af5c8a0af4343a

    SHA256

    203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

    SHA512

    043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

  • \Users\Admin\AppData\Local\Temp\is-PI3FM.tmp\ac7560fd5eae593bc3dd81a19f68647f.tmp

    MD5

    ffcf263a020aa7794015af0edee5df0b

    SHA1

    bce1eb5f0efb2c83f416b1782ea07c776666fdab

    SHA256

    1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

    SHA512

    49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

  • memory/1436-62-0x0000000000000000-mapping.dmp

  • memory/1436-66-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1776-59-0x0000000075C31000-0x0000000075C33000-memory.dmp

    Filesize

    8KB

  • memory/1776-60-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB