Analysis

  • max time kernel
    77s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 13:36

General

  • Target

    ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe

  • Size

    315KB

  • MD5

    71b391d0b819ff6eaa2102a4675de05c

  • SHA1

    ef576d715141b3bb7cf1e7a520490b3160442f80

  • SHA256

    ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b

  • SHA512

    ca596f10b45f16fe589bde09a94dbe9e1b456d6ae5950061ab617927f792b74231dfb1dd3811303a77ecc864f99832df94175efeee3ad66111bb267f817d423e

  • SSDEEP

    6144:6rcbUzkuvcBYC47l2x6VhrsvjcGUk6u2EOhB6nzuY5w:6rhkuveY3bGkz6zuY5w

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe
    "C:\Users\Admin\AppData\Local\Temp\ab084b0485647ca3fcd1734e0b6289c4047e36659ed0cb022fe4f8b8e59e3c8b.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tinFE67.bat"
      2⤵
        PID:4552

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\InstallMate\BA21F4B1\cfg\1.ini

            Filesize

            41KB

            MD5

            90057121e352870776a712cec8bb8cee

            SHA1

            5e8a74104a16826fab10ef108cd3c3a7e562a756

            SHA256

            9502565b05fa9733f8ded5a7f2b9736a0adbcd98333fd1028b7f11950e44e84b

            SHA512

            a69936c52c7bb01b349d02612d537f9f38e06b53e14b2ef2a5dfc107f86c53abf8350659806486c76083026820fe27d3b9a83de0b5c656ad44fda5831e630f58

          • C:\Users\Admin\AppData\Local\Temp\Tsu373A39AB.dll

            Filesize

            269KB

            MD5

            af7ce801c8471c5cd19b366333c153c4

            SHA1

            4267749d020a362edbd25434ad65f98b073581f1

            SHA256

            cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

            SHA512

            88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

          • C:\Users\Admin\AppData\Local\Temp\_tinFE67.bat

            Filesize

            50B

            MD5

            89fb7815ae916bf10ad863f107343415

            SHA1

            2936dd1fb33cdb5e2f59b3748a039689ee03c117

            SHA256

            48a082c0d0dc27be9b0a7b7c1b347dc6ae1946a879e1c9ea6f307ab754399598

            SHA512

            84ee44125ab6605ad45283437a58db4c6008878bb0f1dcecb6ed66e22539656dc9ac955de4fc138d3cc8e1ac12aacb0746d98f21f2d80cd7bd10458dd58f2451

          • C:\Users\Admin\AppData\Local\Temp\{D00BD84A-732A-4BBC-A957-3B080BE8FABC}\Custom.dll

            Filesize

            91KB

            MD5

            2580b4f2c4522fe5cb36e6d3ec09b24a

            SHA1

            39bbe49606478a8d9abcdeca1e84040b4411f219

            SHA256

            7b89020c401d0b5dd46aea117303ec67392eb295555dbfd26ac3beef8417eb00

            SHA512

            eb2c377bcfdc3e9f587e0262c109856abbb07cb9ce3b28d9ec37f0862a611823ea5c856ead54afef0817162e72c51540da053bf4453039d0977f8fdd1050f413

          • C:\Users\Admin\AppData\Local\Temp\{D00BD84A-732A-4BBC-A957-3B080BE8FABC}\_Setup.dll

            Filesize

            173KB

            MD5

            9b02f9d7afb338368b1aab73f21708cd

            SHA1

            a0388f5f972226beea6f6a030deca269d3ffe2dd

            SHA256

            2fda616670264c4cc03f1ce8420dfcc79b79920e836737f6cee360d51413805f

            SHA512

            6381df05f90e9fe07e35c53f7f601ddb74f42988140ca6af075a3edd60282f5620250cd9e86c3a5b04fef2ce4b6cf7971773fdf5a416c271b4381a788dd453e4