Analysis
- max time kernel
137s - max time network
184s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
30/10/2022, 04:14
General
- Target SecuriteInfo.com.Variant.Babar.113038.27709.21665.exe
- Size 350KB
- Sample221030-etm3pscfcj
- SHA256 173bc17148edeb750b8be58b2729f2149083acf4c0e1dd14e99b2de439fe3bed
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Babar.113038.27709.21665.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Babar.113038.27709.21665.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Users\Admin\AppData\Roaming\nsis_unse572952.dll",PrintUIEntry |5CQkOhiAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAOVkHwBs8|AtBTEAYq8AYQAwOQBwJwBNvwBVADQAcTkANvsAVi0CWUiD7Cj|6AQCAABIg8T|KMPMzMxMiUT|JBhIiVQkEEjviUwkCFkBSItEvyQwSIkEJH0BOP1IawAISMdEJBD2LQHrDn0BEEiDwHUBiwEQfQFASDmSAPtzJZsDiwwkSAN|yEiLwUiLTKcB|VR3AAPRSIvKit8JiAjrwWIFZUjviwQlYPPwM8lI|4tQGEg70XQ2|0iDwiBIiwJI|zvCdCpmg3hI|xh1GkyLQFBmv0GDOGt0Bw0RS|t1CA0QeBAudAX|SIsA69VIi0j6+QDBZgBAU1VWV|9BVEFVQVZBV|5ZAWaBOU1aTYv|+EyL8kiL2Q|7hfzz8ExjSTxB|4E8CVBFAAAP+4Xq8|BBi4QJiP7z8IXASI08AQ97hNZmEYO8CYwtAfcPhMfz8ESLZyD|RItfHIt3JET|i08YTAPhTAP|2UgD8TPJRYXvyQ+EpPPwTYvE|0GLEEUz0kgD|9OKAoTAdB1Bv8HKDQ++wPYAAfdEA9C7EXXsQYH|+qr8DXx0DoP|wQFJg8AEQTv|yXNp68aLwQ||twxORYssi0y|A+t0WDPtphB071FBixS9ANMzyf+KAkyLwusPwe3JxBEDyOEQAUGK|QDREO0zwDP2Qec7DLbcEKIAg8YB|4P4CHLu6wpI|4vLQf|VSYkE9|eDxeAQxAQ7b|cYcq9iAUFfQV7|QV1BXF9eXVu+LxdIgexgAWAAi||p6Gb+||9IhW|AD4SZcSBMjasBfYsnEMgz|+ibeSD|jV8ETI1FQjN|0ovL|1QkaHwgv0yL4A+EbHEgRd6kEDPAi9ONIEiJ13wkIKIgcHwgSIvP8A+ETHEgoiBQSP+NVghEjUdASPeNjCSBEUiL2Oi7fP16II1WSNogENreIczz8Ohn6yBEi08GjVcIPSCiIFjGIa+JhCSAgxLd8|CLPQ7WIFiJjCRtEQMw9o0g6DHrIEyLXTq7i6wpMkiLnBYyTP+JZCQ4RI1nbO9JO+xIhiAwTIndXIABhCTcgxGGjvTjId8g8KwTSIvT6Nvn|AEwipxzMkiN|YRzMkGA8yFJi+|MRDAYoAKD6QHvdfOBvHMyIVJlf3h1SouEJPQeMfeUJPjz8APCSDv|6HI1QTvUdjD|RI1JQEkr1EHTuACUAKIgQMYi+HTzF0S0ML4xSI1TbL6NIE0rxOhsgDBI+4vOoiB4SIX|dPMUTIwwFzFIjUwk90C6A|Pw|9dIgRnEcCFdJAAA2⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 6682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4764 -ip 47641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
nsis_unse572952.dll
nsis_unse572952.dll
memory/4764-138-0x0000000002F07000-0x0000000002F2D000-memory.dmp
memory/4764-135-0x00000000030F0000-0x000000000310A000-memory.dmp
memory/4764-136-0x0000000003110000-0x000000000312D000-memory.dmp
memory/4764-137-0x0000000004E50000-0x0000000005E50000-memory.dmp
memory/4764-132-0x0000000002F07000-0x0000000002F2D000-memory.dmp
memory/4764-139-0x0000000000400000-0x0000000002C45000-memory.dmp
memory/4764-140-0x0000000003110000-0x000000000312D000-memory.dmp
memory/4764-143-0x0000000004E50000-0x0000000005E50000-memory.dmp
memory/4764-134-0x0000000000400000-0x0000000002C45000-memory.dmp
memory/4764-133-0x0000000002D90000-0x0000000002DC0000-memory.dmp
memory/4764-145-0x0000000000400000-0x0000000002C45000-memory.dmp
memory/4764-146-0x0000000003110000-0x000000000312D000-memory.dmp