Resubmissions

12-11-2024 01:29

241112-bwgrxs1gnf 10

08-07-2021 12:18

210708-8z6d5h8z2n 10

06-07-2021 17:53

210706-g6we6sa7sa 10

19-06-2021 18:17

210619-vr8bj2dzfn 10

17-06-2021 21:39

210617-a9cvlnmrbx 10

11-06-2021 17:26

210611-wvab1yw2tj 10

08-06-2021 06:47

210608-qrbpch3y46 10

08-06-2021 06:47

210608-64tndgm1ln 10

05-06-2021 18:40

210605-cd6qpr55sx 10

04-06-2021 11:56

210604-5c416rs3ns 10

Analysis

  • max time kernel
    316s
  • max time network
    375s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    19-06-2021 18:17

General

  • Target

    Install2.exe

  • Size

    497KB

  • MD5

    41a5f4fd1ea7cac4aa94a87aebccfef0

  • SHA1

    0d0abf079413a4c773754bf4fda338dc5b9a8ddc

  • SHA256

    97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9

  • SHA512

    5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Install2.exe
    "C:\Users\Admin\AppData\Local\Temp\Install2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3728
    • C:\Users\Admin\AppData\Local\Temp\is-AS3K4.tmp\Install2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-AS3K4.tmp\Install2.tmp" /SL5="$20120,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install2.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-AS3K4.tmp\Install2.tmp

    MD5

    45ca138d0bb665df6e4bef2add68c7bf

    SHA1

    12c1a48e3a02f319a3d3ca647d04442d55e09265

    SHA256

    3960a0597104fc5bbf82bf6c03564a1eb6a829c560d1f50d0a63b4772fafbe37

    SHA512

    cd1a0493c26798eb70b3dabb8a439de7792c4676905cad21c6b3f372213ce9f6b65648245defcd36d4f19285160f41c62e1025e772e6b9f11aa126388ea8364f

  • \Users\Admin\AppData\Local\Temp\is-HSKLV.tmp\idp.dll

    MD5

    8f995688085bced38ba7795f60a5e1d3

    SHA1

    5b1ad67a149c05c50d6e388527af5c8a0af4343a

    SHA256

    203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

    SHA512

    043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

  • memory/512-115-0x0000000000000000-mapping.dmp

  • memory/512-119-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/3728-114-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB