93ca5549b18737699deb942e2404bd373b88f72d2b5d4693bb68456c6d84da02

Resubmissions

22/11/2022, 10:23

221122-me2xbadd8z 8

22/11/2022, 10:19

221122-mckj9add2v 8

22/11/2022, 10:14

221122-l9ql4adc3w 8

Analysis

max time kernel
162s
max time network
181s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe
Size

4.3MB
MD5

19079710e724d00ec52a979335797a6e
SHA1

d28f13775018622f1f3d2a7c721d2fecfee18998
SHA256

93ca5549b18737699deb942e2404bd373b88f72d2b5d4693bb68456c6d84da02
SHA512

ecf31d9366f8cd66759dc15daffe7ea3a0538e07ef13c36bad45db24b0833a2ec8e5b5e36bb711b3209227b8371486c051f0a65ebbf1f47a6b6707df4a0b32e7
SSDEEP

98304:tkLt6hB0m9WZXk8a7EdrL143hPZmKAdKwcNtDGdPBmM:eQBf9WO8amCRPMLKwcNcdPBR

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2028	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp

Loads dropped DLL 3 IoCs

pid	Process
1100	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe
2028	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp
2028	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1560	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1560	AUDIODG.EXE
Token: 33	1560	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1560	AUDIODG.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2028	1100	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe	28
PID 1100 wrote to memory of 2028	1100	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe	28
PID 1100 wrote to memory of 2028	1100	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe	28
PID 1100 wrote to memory of 2028	1100	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe	28
PID 1100 wrote to memory of 2028	1100	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe	28
PID 1100 wrote to memory of 2028	1100	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe	28
PID 1100 wrote to memory of 2028	1100	StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe	28

C:\Users\Admin\AppData\Local\Temp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe
"C:\Users\Admin\AppData\Local\Temp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\is-NVGO8.tmp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NVGO8.tmp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp" /SL5="$80122,3475251,1235968,C:\Users\Admin\AppData\Local\Temp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2028

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-NVGO8.tmp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp

Filesize
3.4MB

MD5
2d8c736e49d6c7b4739418277a32d16e

SHA1
ad2fd43457b75de6af95d1af03edc9c45c9717d7

SHA256
94e86b57bd15d1d8580cdaab9bf56cab05821598ed0c61c153d3c25da417de57

SHA512
01822b7ee33f78ac78005e4184ec67fcf062113ed853ca388bf457652948fc714ffc5d10ff122414e4d74812096b061f13087c673983420d930a108df901e638

Download Submit
\Users\Admin\AppData\Local\Temp\is-NVGO8.tmp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp

Filesize
3.4MB

MD5
2d8c736e49d6c7b4739418277a32d16e

SHA1
ad2fd43457b75de6af95d1af03edc9c45c9717d7

SHA256
94e86b57bd15d1d8580cdaab9bf56cab05821598ed0c61c153d3c25da417de57

SHA512
01822b7ee33f78ac78005e4184ec67fcf062113ed853ca388bf457652948fc714ffc5d10ff122414e4d74812096b061f13087c673983420d930a108df901e638

Download Submit
\Users\Admin\AppData\Local\Temp\is-O29LC.tmp\AppUtils.dll

Filesize
1.8MB

MD5
61313107f86efd528d5e0b15fcc8b8c7

SHA1
4de55bee0decf620de12ee49d8d94d6796d59721

SHA256
99c01c23b88ab7e656ccb05200fec3c12779de7e20fa20aaea034e7a12fc90ef

SHA512
7fcd8fde1ead2ee6e879240f55f3ff4db17e7f716c3fc7f28da1464ed4a1760568427584fe34cfea945c64ab9a8db7b8d50e80e3bc27b8c2c1103aa6846a9dc2

Download Submit
\Users\Admin\AppData\Local\Temp\is-O29LC.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
memory/808-67-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/1100-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1100-55-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/1100-59-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/1100-63-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/1100-66-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/2028-65-0x0000000007610000-0x000000000761F000-memory.dmp

Filesize
60KB

Download