f92d7bc5399737179cbb9e10fc5c083bcca2138881cddfdb7d7a4f6d7c5e3a96

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21/09/2022, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file__escape_from_monkey_island_v1_1_zip__________.exe
Size

1.9MB
MD5

43959b593ea94d58856e4c1eff4dde03
SHA1

e3e850b622bc76c12872a9503197359759b4837f
SHA256

f92d7bc5399737179cbb9e10fc5c083bcca2138881cddfdb7d7a4f6d7c5e3a96
SHA512

afbfa94bfe05b039e34dd1b0eabf2d24f8043a188f7338f834ea39730ef294aa33c6a8277d85bb5e25be2b5c108be9bc806786d913238d75f49d8f700a8c7ba7
SSDEEP

24576:K7FUDowAyrTVE3U5FmJT72pQ0qr/ygA8XVKZzs29eo5x7awFhJdNo69lOy7KTiju:KBuZrEUAa3qrU8UZzs29555DdN7POGju

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1188	file__escape_from_monkey_island_v1_1_zip__________.tmp

Loads dropped DLL 2 IoCs

pid	Process
1436	file__escape_from_monkey_island_v1_1_zip__________.exe
1188	file__escape_from_monkey_island_v1_1_zip__________.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1188	1436	file__escape_from_monkey_island_v1_1_zip__________.exe	27
PID 1436 wrote to memory of 1188	1436	file__escape_from_monkey_island_v1_1_zip__________.exe	27
PID 1436 wrote to memory of 1188	1436	file__escape_from_monkey_island_v1_1_zip__________.exe	27
PID 1436 wrote to memory of 1188	1436	file__escape_from_monkey_island_v1_1_zip__________.exe	27
PID 1436 wrote to memory of 1188	1436	file__escape_from_monkey_island_v1_1_zip__________.exe	27
PID 1436 wrote to memory of 1188	1436	file__escape_from_monkey_island_v1_1_zip__________.exe	27
PID 1436 wrote to memory of 1188	1436	file__escape_from_monkey_island_v1_1_zip__________.exe	27

C:\Users\Admin\AppData\Local\Temp\file__escape_from_monkey_island_v1_1_zip__________.exe
"C:\Users\Admin\AppData\Local\Temp\file__escape_from_monkey_island_v1_1_zip__________.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\is-BGA3B.tmp\file__escape_from_monkey_island_v1_1_zip__________.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BGA3B.tmp\file__escape_from_monkey_island_v1_1_zip__________.tmp" /SL5="$A011C,1133529,832512,C:\Users\Admin\AppData\Local\Temp\file__escape_from_monkey_island_v1_1_zip__________.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-BGA3B.tmp\file__escape_from_monkey_island_v1_1_zip__________.tmp

Filesize
3.0MB

MD5
9c08f2d5fdf75be4e245de2af327aad0

SHA1
35531017bc790ad3e24d61679ed49e0a8e2502b6

SHA256
7f40052235be5183353f51ca74d2c76f16db1e6ec3fe3fcbc37b345a7aa2a7b0

SHA512
06f682ca37697cc0758a3204be765380decd9c647a72899488c8a4ca849f8b03778417c470bc1bfa45492b16733d7f0c9ae04307bd9bee997f0605e13cd68147

Download Submit
\Users\Admin\AppData\Local\Temp\is-BGA3B.tmp\file__escape_from_monkey_island_v1_1_zip__________.tmp

Filesize
3.0MB

MD5
9c08f2d5fdf75be4e245de2af327aad0

SHA1
35531017bc790ad3e24d61679ed49e0a8e2502b6

SHA256
7f40052235be5183353f51ca74d2c76f16db1e6ec3fe3fcbc37b345a7aa2a7b0

SHA512
06f682ca37697cc0758a3204be765380decd9c647a72899488c8a4ca849f8b03778417c470bc1bfa45492b16733d7f0c9ae04307bd9bee997f0605e13cd68147

Download Submit
\Users\Admin\AppData\Local\Temp\is-HT80Q.tmp\service.dll

Filesize
369KB

MD5
d20aed9970a8a87451a22a96835dcda6

SHA1
dcfd841248beb26c01ddffefbd9175d5807ab758

SHA256
8d4f2a0ffccbb87f22d22623187a62e17f9236280b31af7b6a0d8632760433fd

SHA512
8f7d0004d83001e6d0ce0ab1536eae2f733f3973194947c2c152202298e09d4ac594defe2e7f7a86a85dae43cf8a7cacbbb673abeac091461c2a8dc306f3d675

Download Submit
memory/1436-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1436-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1436-62-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1436-63-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads