Analysis

  • max time kernel
    92s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 07:04

General

  • Target

    f07fe4c202a38b94c7d117263c128348667c8e5b554b239464dd61227a7d93b8.exe

  • Size

    618KB

  • MD5

    c1700ddd135a8bf68e5d2c69fd5840b9

  • SHA1

    bdf84804b3c1d67ad617398d8cab1ed097c00ebe

  • SHA256

    f07fe4c202a38b94c7d117263c128348667c8e5b554b239464dd61227a7d93b8

  • SHA512

    6cf6592e862059e764d87b5b20c6e6b9ef0075ff9d79b0de5dec8804456d3dca5b3c3b012306ee51201dff7f37b1975766278d4c5f47b7f7e29f407abcd6c0a5

  • SSDEEP

    12288:XrrjkogdCi7WNwx9l8oEGkuveY39Bn3Y4z9GiC0bZ6SBDn:AogvWNwmDuXnnI4zUiC093

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f07fe4c202a38b94c7d117263c128348667c8e5b554b239464dd61227a7d93b8.exe
    "C:\Users\Admin\AppData\Local\Temp\f07fe4c202a38b94c7d117263c128348667c8e5b554b239464dd61227a7d93b8.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4216
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tinF081.bat"
      2⤵
        PID:4976

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\InstallMate\5A73FAD9\cfg\1.ini

      Filesize

      368B

      MD5

      3a9830a2f57ef1e602de02bd9cc8eb56

      SHA1

      5135a0295755e536b833c6c6010900ff99cdbabf

      SHA256

      8d138bedf3228f7ef9405940526a73f49395fd2917aa22e7d5596297e222da42

      SHA512

      87ed85acdc1509bb02e437f50e7a90695f66b2a7a996a526f0310ba277de9ce8d7343983e2ae0b5dbedcca832bb90da802d7182972f1b14be0a203cfbd14cc41

    • C:\Users\Admin\AppData\Local\Temp\TsuB30F68AB.dll

      Filesize

      269KB

      MD5

      af7ce801c8471c5cd19b366333c153c4

      SHA1

      4267749d020a362edbd25434ad65f98b073581f1

      SHA256

      cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

      SHA512

      88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

    • C:\Users\Admin\AppData\Local\Temp\_tinF081.bat

      Filesize

      50B

      MD5

      412a93574b8a81f6e592025fde61ce1c

      SHA1

      5e800ca8e65d561fdcfcc29f273131523cf21bd1

      SHA256

      7381f893f82bef584c5dac4ad14a06b8f622b7f4649a533f1d1af577808de9ef

      SHA512

      3e248d3199359e0609c58c5184cb5478bd4f16e831eec6d716974fc92c1561c345c783e6c92403054287c7e3432c9769f783e2b35f1ff67c15274640ca98fe1b

    • C:\Users\Admin\AppData\Local\Temp\{E50DE0EE-F80F-48B8-AA53-B02D3EEEC218}\Custom.dll

      Filesize

      91KB

      MD5

      04507520792deecbc5f3f32f52f5bd66

      SHA1

      7851ba3099ab9094535d04d7345af1269745b00b

      SHA256

      ebd3a1d2bba2e850b5b73c2deebbb649defd6111b1790fb4d46747098583e51d

      SHA512

      d7c1bcec8fa30b1510ef73c2559e53e2917ba712b6f2c8bdb54f2a0018c6ebdbbcef9e263138dc804338ec3595570b5aaac30584ffee92549f6063b7be3efe62

    • C:\Users\Admin\AppData\Local\Temp\{E50DE0EE-F80F-48B8-AA53-B02D3EEEC218}\_Setup.dll

      Filesize

      375KB

      MD5

      35560942b4a2335e86a96c293315f4a9

      SHA1

      28bb474564b25dc3e0133c0548b2d9ccc8ea763d

      SHA256

      96c888740c2e0fa6d85672c35f9f4a807c30d778b93315fd1978774b48e92352

      SHA512

      67235be9251325bffbb23669994fb905bedbfb196e480c880ec9611f845bd483bbfbd089d2cf91fe8066029eedecf1cdcdf9138c44689b23aa3fd2afafa1749f

    • memory/4976-135-0x0000000000000000-mapping.dmp