Analysis
-
max time kernel
90s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16/09/2022, 21:10
Static task
static1
Behavioral task
behavioral1
Sample
Setup RX Pro Audio Editor v10.0.0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Setup RX Pro Audio Editor v10.0.0.exe
Resource
win10v2004-20220812-en
General
-
Target
Setup RX Pro Audio Editor v10.0.0.exe
-
Size
646.7MB
-
MD5
777565d79fecfbf7e0c0fc1084216aa6
-
SHA1
afeb1ca73075ce9a8937b056b03aee7a6cfdbfaf
-
SHA256
f48a1be304c3a369648845292d1f895882326cf2a28d6705324efe966e447a38
-
SHA512
031f1c36ed46ac527b0e8ecd8949481eb1d8353d6e980f6b537033d5c1da2280c23e69c40190afd604c17a05a078f3c57cd94163dfc424047e92221fa905bce4
-
SSDEEP
12582912:eAUwBAkobzbZapLJ6ACAhuMrPxdYlGChbT01jQnHKPwKVfPsKDAQn1N/W3H:RU5DZaNlHj4lrTysGxPsKDAsu3H
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 980 Setup RX Pro Audio Editor v10.0.0.tmp -
Loads dropped DLL 5 IoCs
pid Process 980 Setup RX Pro Audio Editor v10.0.0.tmp 980 Setup RX Pro Audio Editor v10.0.0.tmp 980 Setup RX Pro Audio Editor v10.0.0.tmp 980 Setup RX Pro Audio Editor v10.0.0.tmp 980 Setup RX Pro Audio Editor v10.0.0.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 980 Setup RX Pro Audio Editor v10.0.0.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 424 wrote to memory of 980 424 Setup RX Pro Audio Editor v10.0.0.exe 79 PID 424 wrote to memory of 980 424 Setup RX Pro Audio Editor v10.0.0.exe 79 PID 424 wrote to memory of 980 424 Setup RX Pro Audio Editor v10.0.0.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup RX Pro Audio Editor v10.0.0.exe"C:\Users\Admin\AppData\Local\Temp\Setup RX Pro Audio Editor v10.0.0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\is-QFHI2.tmp\Setup RX Pro Audio Editor v10.0.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-QFHI2.tmp\Setup RX Pro Audio Editor v10.0.0.tmp" /SL5="$C01D0,677669010,121344,C:\Users\Admin\AppData\Local\Temp\Setup RX Pro Audio Editor v10.0.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:980
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
4KB
MD55df8ada84a16f5dfc24096ef90a5ce3a
SHA15e7e9c68119c3a0a1afc92c60674bc8714492823
SHA25648a9c8c332fde541b571d9d522d0e37834b452f55af8cbdc341b12222e78fb5b
SHA512661b5219c74dd6e3a8e899a1b1a3002689d148e337d7323a174519366c9548c284ee76e2faa2f9600cd483db21093ee62399f0d7403c39523c654266760191c2
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb