2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43

Analysis

max time kernel
75s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.exe
Size

8.4MB
MD5

f7e9d3721e4bf513928311525e4913b0
SHA1

e27dafe78b19d50927690e7cc3ed55f3e86e2d8a
SHA256

2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43
SHA512

65f4f2e0036746153c6288b9201a7883f48ee9b0de20bc676a8487d174c40706dfe0edfd2f6c12990a264fbe8626f7421ccb3262107c7ae82765cc6c4cdd15fb
SSDEEP

196608:R/NBq0TIXHko/yjngzAVLhejlzgw2U9RE:jQygz8hehzgwhrE

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1172	2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.tmp

Loads dropped DLL 3 IoCs

pid	Process
1172	2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.tmp
1172	2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.tmp
1172	2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1172	2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1172	2448	2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.exe	80
PID 2448 wrote to memory of 1172	2448	2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.exe	80
PID 2448 wrote to memory of 1172	2448	2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.exe	80

C:\Users\Admin\AppData\Local\Temp\2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.exe
"C:\Users\Admin\AppData\Local\Temp\2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\is-L0RCL.tmp\2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-L0RCL.tmp\2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.tmp" /SL5="$100052,8389298,214528,C:\Users\Admin\AppData\Local\Temp\2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-L0RCL.tmp\2e52f38bab49f80195331471e41f6cfe4ae44507e96a88e0d67055ef6b958f43.tmp

Filesize
1.2MB

MD5
988cb11f496642047d6b74598ba71bd0

SHA1
e4de6c0bc0e95128558bf0c8287f47973d85122c

SHA256
71f76e76c31f5280c0a90936ac14887e10f3457fba28ccc07e30ccdc386c4a85

SHA512
41d8304ffe7771883a219dfcfe17001e6a4b3d71ceec49f875b46592a318f8d4e46d81a430f74622122a5bd3595e4a49b584852554ac211022be5920a516760f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LV3G6.tmp\ConnectUtils.dll

Filesize
90KB

MD5
546f248f2cc3fc1b324d6c7129ff8662

SHA1
f782e87c4bb24e8f4bfcf5174b9131821c71d668

SHA256
31508d700cc570c172b6cc7d92da2083ce3a4568bbff979967f1e72da3493c94

SHA512
9dac51b5bb0069a1977b30444fa96f5ee60290900c5d84b4b6b71ff6c981436088dff46a459b4696bb52986855794250e750078ffbe93f8f8361e4fed315aba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LV3G6.tmp\ConnectUtils.dll

Filesize
90KB

MD5
546f248f2cc3fc1b324d6c7129ff8662

SHA1
f782e87c4bb24e8f4bfcf5174b9131821c71d668

SHA256
31508d700cc570c172b6cc7d92da2083ce3a4568bbff979967f1e72da3493c94

SHA512
9dac51b5bb0069a1977b30444fa96f5ee60290900c5d84b4b6b71ff6c981436088dff46a459b4696bb52986855794250e750078ffbe93f8f8361e4fed315aba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LV3G6.tmp\execctrl.dll

Filesize
10KB

MD5
9c497a6cfb4035ae006619919e23e45c

SHA1
d2b1534ce30a90ee962976b8921bea6eb80846e7

SHA256
20646bf003ca8d986737e66ef6200154af7376a69d908777f5c9c37a513c0d8a

SHA512
e92f58ae4c4cf81ec49e1386841be2b74f00da51cc282345dd4af1c430956b9eda3ad3a60d642eea448eff69a0fa7775bf99363efc31fcb09fe411c5dae972e5

Download Submit
memory/1172-140-0x0000000002600000-0x0000000002620000-memory.dmp

Filesize
128KB

Download
memory/2448-132-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2448-134-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2448-141-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads