01320a48d2d6c636502010f75f23e5fae27f06ce628b40ef0548fad5f5bc8834

General

Target

a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe
Size

1.7MB
MD5

2c1c93a93645d3deb11692760a713df4
SHA1

9178ac91eb42073926397cae1e6109b95a4ac35f
SHA256

a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf
SHA512

be41c283ae65bca975e8495f77857d4a97296867e244acc0c0fc38c78ff30caa706eeb8165ce4dbac908150673d3e74123b46052bfdea038d40cd896134fc314
SSDEEP

24576:n4nXubIQGyxbPV0db26Wmd0l4sv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdOi:nqe3f61mZSffPMWrQ0Zkd

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmpfile_.exefile_.tmp

pid process

4296 a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
5000 file_.exe
2032 file_.tmp
Loads dropped DLL 3 IoCs

Processes:

file_.tmp

pid process

2032 file_.tmp
2032 file_.tmp
2032 file_.tmp
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 12 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp

pid process

4296 a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp

pid	process
4296	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
5000	file_.exe
2032	file_.tmp

pid	process
2032	file_.tmp
2032	file_.tmp
2032	file_.tmp

description	flow	ioc
HTTP User-Agent header	12	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
4296	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exea2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmpfile_.exe

description	pid	process	target process
PID 1584 wrote to memory of 4296	1584	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
PID 1584 wrote to memory of 4296	1584	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
PID 1584 wrote to memory of 4296	1584	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
PID 4296 wrote to memory of 5000	4296	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp	file_.exe
PID 4296 wrote to memory of 5000	4296	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp	file_.exe
PID 4296 wrote to memory of 5000	4296	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp	file_.exe
PID 5000 wrote to memory of 2032	5000	file_.exe	file_.tmp
PID 5000 wrote to memory of 2032	5000	file_.exe	file_.tmp
PID 5000 wrote to memory of 2032	5000	file_.exe	file_.tmp

C:\Users\Admin\AppData\Local\Temp\a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe
"C:\Users\Admin\AppData\Local\Temp\a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Users\Admin\AppData\Local\Temp\is-2MG7I.tmp\a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2MG7I.tmp\a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp" /SL5="$501EC,831488,831488,C:\Users\Admin\AppData\Local\Temp\a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe"
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4296

C:\Users\Admin\AppData\Local\Temp\is-S25M5.tmp\file_.exe
"C:\Users\Admin\AppData\Local\Temp\is-S25M5.tmp\file_.exe" /LANG=en /NA=Rh85hR64
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000

C:\Users\Admin\AppData\Local\Temp\is-JEBAN.tmp\file_.tmp
"C:\Users\Admin\AppData\Local\Temp\is-JEBAN.tmp\file_.tmp" /SL5="$C01E4,1577628,798720,C:\Users\Admin\AppData\Local\Temp\is-S25M5.tmp\file_.exe" /LANG=en /NA=Rh85hR64
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-2MG7I.tmp\a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp

Filesize
3.0MB

MD5
0c229cd26910820581b5809c62fe5619

SHA1
28c0630385b21f29e3e2bcc34865e5d15726eaa0

SHA256
abfa49a915d2e0a82561ca440365e6a2d59f228533b56a8f78addf000a1081b3

SHA512
b8ff3dc65f7c0e03721572af738ec4886ba895dc70c1a41a3ce8c8abe0946d167cec71913017fd11d5892452db761ea88901a5a09a681ae779dd531edbb83a2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H4V8C.tmp\Helper.dll

Filesize
2.0MB

MD5
4eb0347e66fa465f602e52c03e5c0b4b

SHA1
fdfedb72614d10766565b7f12ab87f1fdca3ea81

SHA256
c73e53cbb7b98feafe27cc7de8fdad51df438e2235e91891461c5123888f73cc

SHA512
4c909a451059628119f92b2f0c8bcd67b31f63b57d5339b6ce8fd930be5c9baf261339fdd9da820321be497df8889ce7594b7bfaadbaa43c694156651bf6c1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H4V8C.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H4V8C.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JEBAN.tmp\file_.tmp

Filesize
2.9MB

MD5
4186cf42a2321ac3fac422f87c74db86

SHA1
8ecabb8f9b852e65eeab2b666cf89f2c54d4cba5

SHA256
0ea001beca6f62dd410158c78e7aaf9fd56a71ad33a7c5af0899b33608eed7bb

SHA512
c7ca63c97ebf5754564819d7a59439e73699803adac1cdf6e6c9593763de5e106c05715df0b72c02bc6dfb4605d152892267957df8a90da48fa57d4c65989329

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-S25M5.tmp\file_.exe

Filesize
2.4MB

MD5
94b2324618fb2b1cef0d93cf96a1b16b

SHA1
ee4ad577b6e71e020240c274c7af18f2829f21a7

SHA256
1ee04269902716b8ca585d2525ab66c4b2098dc14eb717ed548432e62f45bbef

SHA512
e9afa3eb935df1217ac093949dca623418a304fd831de527e738c7a6c59309472f1d7fcec02b07752f48e8078a2be548a654979e179cade2c14ccbb31a3475bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-S25M5.tmp\file_.exe

Filesize
2.4MB

MD5
94b2324618fb2b1cef0d93cf96a1b16b

SHA1
ee4ad577b6e71e020240c274c7af18f2829f21a7

SHA256
1ee04269902716b8ca585d2525ab66c4b2098dc14eb717ed548432e62f45bbef

SHA512
e9afa3eb935df1217ac093949dca623418a304fd831de527e738c7a6c59309472f1d7fcec02b07752f48e8078a2be548a654979e179cade2c14ccbb31a3475bc

Download Submit
memory/1584-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1584-132-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1584-146-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1584-147-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2032-143-0x0000000000000000-mapping.dmp

Download
memory/2032-151-0x0000000006350000-0x000000000635F000-memory.dmp

Filesize
60KB

Download
memory/4296-134-0x0000000000000000-mapping.dmp

Download
memory/5000-137-0x0000000000000000-mapping.dmp

Download
memory/5000-148-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/5000-142-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/5000-139-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/5000-152-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download

Analysis

Sharing