8b8524d99c41e32912669ff4be7aba713495ad3fc03e345c5a7e16d473718e48

Analysis

max time kernel
315s
max time network
1744s
platform
windows10_x64
resource
win10v20210408
submitted
06-08-2021 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Raccine/preqeq/vc_redist.x86.exe
Size

13.5MB
MD5

7f5d52f979b732954e87c53dc9720fc0
SHA1

e99e5b17b0ad882833bbdc8cf798dc56f9947a5e
SHA256

ea92c3f93bc063d6da084faa854c131e37f1f2cb585cd1e62a3df9e03eacadff
SHA512

7104b2519c9b0edd4db9b6caf7ad1e4586be6bc64144048df747ff9625196397c249ca1e51562a24e68da863a05c7e0893ed54fd52fb117f60d05bb8b834d512

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

vc_redist.x86.exe

pid process

1732 vc_redist.x86.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1732	vc_redist.x86.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

vc_redist.x86.exe

description	pid	process	target process
PID 3128 wrote to memory of 1732	3128	vc_redist.x86.exe	vc_redist.x86.exe
PID 3128 wrote to memory of 1732	3128	vc_redist.x86.exe	vc_redist.x86.exe
PID 3128 wrote to memory of 1732	3128	vc_redist.x86.exe	vc_redist.x86.exe

C:\Users\Admin\AppData\Local\Temp\Raccine\preqeq\vc_redist.x86.exe
"C:\Users\Admin\AppData\Local\Temp\Raccine\preqeq\vc_redist.x86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3128

C:\Users\Admin\AppData\Local\Temp\Raccine\preqeq\vc_redist.x86.exe
"C:\Users\Admin\AppData\Local\Temp\Raccine\preqeq\vc_redist.x86.exe" -burn.unelevated BurnPipe.{21C3D8B2-2F46-49B6-8452-E3F186A8A1A3} {3C0602ED-0C45-4CC0-B0D5-E3971F2448A6} 3128
2⤵
- Loads dropped DLL
PID:1732

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\{206898cc-4b41-4d98-ac28-9f9ae57f91fe}\.ba1\wixstdba.dll
MD5
4d20a950a3571d11236482754b4a8e76

SHA1
e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c

SHA256
a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b

SHA512
8b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2

Download Submit
memory/1732-114-0x0000000000000000-mapping.dmp

Download