Resubmissions

10-11-2021 14:52

211110-r84p8aedej 10

09-11-2021 13:19

211109-qkrv3sfcg4 10

Analysis

  • max time kernel
    121s
  • max time network
    300s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    10-11-2021 14:52

General

  • Target

    78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.exe

  • Size

    504KB

  • MD5

    7f1faa8a4ddb32af19428f462da72136

  • SHA1

    c7dea48daab84594fa0138542c274e8e9ce1fedf

  • SHA256

    78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd

  • SHA512

    f8a4c204224d200f326f7782e4b1024cd2745631727f948eb7904267113d062a0f34d1b53b6b972e0dbf4f37e4e08b5b4b8e6878f3677100513fbf515ef84057

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.exe
    "C:\Users\Admin\AppData\Local\Temp\78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Users\Admin\AppData\Local\Temp\is-GRT8V.tmp\78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-GRT8V.tmp\78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.tmp" /SL5="$601C0,247014,163328,C:\Users\Admin\AppData\Local\Temp\78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-GRT8V.tmp\78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.tmp
    MD5

    206baca178d6ba6fbaff62dad0fbcc75

    SHA1

    4845757f4f4f42f5492befbbf2fc920a0947608e

    SHA256

    dcb39cd6f7de41986c237d1747fb9b85867db69ab8ff1edbb9804c513efd5b2c

    SHA512

    7326179ec0225978b0dc2b77d4e2c134f79aa68d2ad163919400c8614a31182c79fd7aef5ba9a99555b3fa19666718d64c41c3529bddc4a65f1df8ec391eb234

  • \Users\Admin\AppData\Local\Temp\is-J0GRQ.tmp\idp.dll
    MD5

    8f995688085bced38ba7795f60a5e1d3

    SHA1

    5b1ad67a149c05c50d6e388527af5c8a0af4343a

    SHA256

    203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

    SHA512

    043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

  • memory/1300-120-0x0000000000400000-0x000000000042E000-memory.dmp
    Filesize

    184KB

  • memory/3124-121-0x0000000000000000-mapping.dmp
  • memory/3124-123-0x00000000001E0000-0x00000000001E1000-memory.dmp
    Filesize

    4KB