Analysis
-
max time kernel
143s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:50
Static task
static1
Behavioral task
behavioral1
Sample
DigioSmartClientWinV1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
DigioSmartClientWinV1.exe
Resource
win10v2004-20221111-en
General
-
Target
DigioSmartClientWinV1.exe
-
Size
2.6MB
-
MD5
2c26a5fe35fb0d917f94abf706dc37ca
-
SHA1
3aacc94414991041c970ef8f09980e5966e9e18b
-
SHA256
76920592836662d1651d20afd9ac1afee41c96324e1cb7ddfde3698edc4dc628
-
SHA512
a6f39e56017beac8e7a1085e415e5e52d439d7a6ed6bdd59505e44bdcf39f253ceede3f4754bcf13c508d51247e04d8bcf2b6259c569bdeb98282c9d8c60a1b6
-
SSDEEP
49152:m75D5c14Z/7oFu9TNtROHcXUY2he3E/6BaMT8N2x9mV7dfR:K504Z/7x9XRO8F2c3GN2vYJ5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
DigioSmartClientWinV1.tmppid process 620 DigioSmartClientWinV1.tmp -
Loads dropped DLL 1 IoCs
Processes:
DigioSmartClientWinV1.exepid process 1636 DigioSmartClientWinV1.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
DigioSmartClientWinV1.exedescription pid process target process PID 1636 wrote to memory of 620 1636 DigioSmartClientWinV1.exe DigioSmartClientWinV1.tmp PID 1636 wrote to memory of 620 1636 DigioSmartClientWinV1.exe DigioSmartClientWinV1.tmp PID 1636 wrote to memory of 620 1636 DigioSmartClientWinV1.exe DigioSmartClientWinV1.tmp PID 1636 wrote to memory of 620 1636 DigioSmartClientWinV1.exe DigioSmartClientWinV1.tmp PID 1636 wrote to memory of 620 1636 DigioSmartClientWinV1.exe DigioSmartClientWinV1.tmp PID 1636 wrote to memory of 620 1636 DigioSmartClientWinV1.exe DigioSmartClientWinV1.tmp PID 1636 wrote to memory of 620 1636 DigioSmartClientWinV1.exe DigioSmartClientWinV1.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\DigioSmartClientWinV1.exe"C:\Users\Admin\AppData\Local\Temp\DigioSmartClientWinV1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\is-VNNBN.tmp\DigioSmartClientWinV1.tmp"C:\Users\Admin\AppData\Local\Temp\is-VNNBN.tmp\DigioSmartClientWinV1.tmp" /SL5="$70122,2498203,62976,C:\Users\Admin\AppData\Local\Temp\DigioSmartClientWinV1.exe"2⤵
- Executes dropped EXE
PID:620
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
702KB
MD53aa677774c26200eb78f1c5e23ee981c
SHA146688b35cc291c45b2eea674cc8cee4420652ecf
SHA2568106da5409b257dd305a2de755abc653a48e158f7a8d6348a9a5ad36c5708e37
SHA512b234f4dc2c85e47a9bc4616b1e53d20ce428c14e2487332d05c8cc4edc94486c79869a78c4761dc8c41ede8d9808b974c2da0a285f6a74a9ef581a460bfc7557
-
Filesize
702KB
MD53aa677774c26200eb78f1c5e23ee981c
SHA146688b35cc291c45b2eea674cc8cee4420652ecf
SHA2568106da5409b257dd305a2de755abc653a48e158f7a8d6348a9a5ad36c5708e37
SHA512b234f4dc2c85e47a9bc4616b1e53d20ce428c14e2487332d05c8cc4edc94486c79869a78c4761dc8c41ede8d9808b974c2da0a285f6a74a9ef581a460bfc7557