Analysis

  • max time kernel
    149s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 14:09

General

  • Target

    53146f92d6626bd3309a114261770ac7223dcfe2e053fa1cc891dbdfc9e8b1bd.exe

  • Size

    2.1MB

  • MD5

    8dcf2eae5003db4db283663dbc7abd79

  • SHA1

    bb766e2a2670caa4ff2d93ed6e018e4f542bbaeb

  • SHA256

    53146f92d6626bd3309a114261770ac7223dcfe2e053fa1cc891dbdfc9e8b1bd

  • SHA512

    c6c2d1307fa14952734388009193bce39936d0c3c95a86debef2dbb4200311572b7479f6eb9e68a54ade133907813ec98930580277f80ec5c6b21a1ca4de0c54

  • SSDEEP

    24576:VxGck7OVIZ3XoCefjxfgXGGmRe5IT4CrQ5uOu/vRVJouhKhkAdm4zn0G6BzzwNM8:OniVs3XoCefBgXGHpH0tKzJ1+kGroXwt

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\53146f92d6626bd3309a114261770ac7223dcfe2e053fa1cc891dbdfc9e8b1bd.exe
    "C:\Users\Admin\AppData\Local\Temp\53146f92d6626bd3309a114261770ac7223dcfe2e053fa1cc891dbdfc9e8b1bd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Users\Admin\AppData\Local\Temp\is-LFRG1.tmp\53146f92d6626bd3309a114261770ac7223dcfe2e053fa1cc891dbdfc9e8b1bd.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-LFRG1.tmp\53146f92d6626bd3309a114261770ac7223dcfe2e053fa1cc891dbdfc9e8b1bd.tmp" /SL5="$8005C,1760428,119296,C:\Users\Admin\AppData\Local\Temp\53146f92d6626bd3309a114261770ac7223dcfe2e053fa1cc891dbdfc9e8b1bd.exe"
      2⤵
      • Executes dropped EXE
      PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-LFRG1.tmp\53146f92d6626bd3309a114261770ac7223dcfe2e053fa1cc891dbdfc9e8b1bd.tmp

    Filesize

    1.1MB

    MD5

    4de6f44810bad050ac81f45549d58f34

    SHA1

    e001b982a0a978deed96789f943bf295dd2ba1d8

    SHA256

    cf8a77f4cbd38f6ab44fcff738f81ec8dfdaa7ef5a64d62fdd84c6fe897adff5

    SHA512

    550e468c3d6660ce2030fca16549eace9153610e19621cba83fea691f8d0091edb596a869168cf4b7f80fa55a808ca1703e4e2beffb3ade5af3fb67b6ead6673

  • C:\Users\Admin\AppData\Local\Temp\is-LFRG1.tmp\53146f92d6626bd3309a114261770ac7223dcfe2e053fa1cc891dbdfc9e8b1bd.tmp

    Filesize

    1.1MB

    MD5

    4de6f44810bad050ac81f45549d58f34

    SHA1

    e001b982a0a978deed96789f943bf295dd2ba1d8

    SHA256

    cf8a77f4cbd38f6ab44fcff738f81ec8dfdaa7ef5a64d62fdd84c6fe897adff5

    SHA512

    550e468c3d6660ce2030fca16549eace9153610e19621cba83fea691f8d0091edb596a869168cf4b7f80fa55a808ca1703e4e2beffb3ade5af3fb67b6ead6673

  • memory/4920-132-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/4920-137-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/4920-138-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB