93ca5549b18737699deb942e2404bd373b88f72d2b5d4693bb68456c6d84da02

Resubmissions

22/11/2022, 10:23

221122-me2xbadd8z 8

22/11/2022, 10:19

221122-mckj9add2v 8

22/11/2022, 10:14

221122-l9ql4adc3w 8

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe
Size

4.3MB
MD5

19079710e724d00ec52a979335797a6e
SHA1

d28f13775018622f1f3d2a7c721d2fecfee18998
SHA256

93ca5549b18737699deb942e2404bd373b88f72d2b5d4693bb68456c6d84da02
SHA512

ecf31d9366f8cd66759dc15daffe7ea3a0538e07ef13c36bad45db24b0833a2ec8e5b5e36bb711b3209227b8371486c051f0a65ebbf1f47a6b6707df4a0b32e7
SSDEEP

98304:tkLt6hB0m9WZXk8a7EdrL143hPZmKAdKwcNtDGdPBmM:eQBf9WO8amCRPMLKwcNcdPBR

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4688	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp

Loads dropped DLL 3 IoCs

pid	Process
4688	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp
4688	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp
4688	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4688	2472	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe	83
PID 2472 wrote to memory of 4688	2472	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe	83
PID 2472 wrote to memory of 4688	2472	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe	83

C:\Users\Admin\AppData\Local\Temp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe
"C:\Users\Admin\AppData\Local\Temp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\is-THD99.tmp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-THD99.tmp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp" /SL5="$80044,3475251,1235968,C:\Users\Admin\AppData\Local\Temp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:4688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-SHS4K.tmp\AppUtils.dll

Filesize
1.8MB

MD5
61313107f86efd528d5e0b15fcc8b8c7

SHA1
4de55bee0decf620de12ee49d8d94d6796d59721

SHA256
99c01c23b88ab7e656ccb05200fec3c12779de7e20fa20aaea034e7a12fc90ef

SHA512
7fcd8fde1ead2ee6e879240f55f3ff4db17e7f716c3fc7f28da1464ed4a1760568427584fe34cfea945c64ab9a8db7b8d50e80e3bc27b8c2c1103aa6846a9dc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SHS4K.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SHS4K.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-THD99.tmp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp

Filesize
3.4MB

MD5
2d8c736e49d6c7b4739418277a32d16e

SHA1
ad2fd43457b75de6af95d1af03edc9c45c9717d7

SHA256
94e86b57bd15d1d8580cdaab9bf56cab05821598ed0c61c153d3c25da417de57

SHA512
01822b7ee33f78ac78005e4184ec67fcf062113ed853ca388bf457652948fc714ffc5d10ff122414e4d74812096b061f13087c673983420d930a108df901e638

Download Submit
memory/2472-132-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/2472-134-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/2472-141-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/4688-140-0x0000000005680000-0x000000000568F000-memory.dmp

Filesize
60KB

Download