366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec

Analysis

max time kernel
131s
max time network
45s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.exe
Size

1.7MB
MD5

865ffed2191995429a8eedc137acc9de
SHA1

73bbc0052e78907cdab108f197bbe87d7bccb184
SHA256

366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec
SHA512

85be218a19ffb467b85dc6d040485660d515f6bd6e93cc2a5a8ddbf2921c903637609b94536c8114ea4d3f2e20e55aeabed85b9783a3d22e8f2b63872a1ab43e
SSDEEP

49152:O9oVeRoRd7jI5UDPOTeT+esvRUJlSy577ggTgczJV:ofc1j2Uu/vROl7XLX

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1272	366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.tmp

Loads dropped DLL 3 IoCs

pid	Process
1296	366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.exe
1272	366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.tmp
1272	366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1272	366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1272	1296	366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.exe	27
PID 1296 wrote to memory of 1272	1296	366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.exe	27
PID 1296 wrote to memory of 1272	1296	366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.exe	27
PID 1296 wrote to memory of 1272	1296	366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.exe	27
PID 1296 wrote to memory of 1272	1296	366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.exe	27
PID 1296 wrote to memory of 1272	1296	366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.exe	27
PID 1296 wrote to memory of 1272	1296	366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.exe	27

C:\Users\Admin\AppData\Local\Temp\366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.exe
"C:\Users\Admin\AppData\Local\Temp\366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Local\Temp\is-352DU.tmp\366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-352DU.tmp\366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.tmp" /SL5="$70122,1488216,56832,C:\Users\Admin\AppData\Local\Temp\366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-352DU.tmp\366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.tmp

Filesize
693KB

MD5
0b67a77acd18e5af96c5c8e145a39466

SHA1
7e956c4f14d9e3a46705f590c75f2271bf836698

SHA256
fa051c7ae2837168225e4a3861048295eae48fe2fb8eebcb2b2551cfdbcc1bae

SHA512
870cec905d5d3f7c10e38eacaf497ec796f7f4e4284da4f8075cb77719275497748bd831ba58640910b22830c27a4902aa0491b1c192cb2866125d8cc00f56c0

Download Submit
\Users\Admin\AppData\Local\Temp\is-352DU.tmp\366a9382bd07db36a853e9c8e3eff3243da79c65031599da71525783fd6a6fec.tmp

Filesize
693KB

MD5
0b67a77acd18e5af96c5c8e145a39466

SHA1
7e956c4f14d9e3a46705f590c75f2271bf836698

SHA256
fa051c7ae2837168225e4a3861048295eae48fe2fb8eebcb2b2551cfdbcc1bae

SHA512
870cec905d5d3f7c10e38eacaf497ec796f7f4e4284da4f8075cb77719275497748bd831ba58640910b22830c27a4902aa0491b1c192cb2866125d8cc00f56c0

Download Submit
\Users\Admin\AppData\Local\Temp\is-QA23P.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-QA23P.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1296-54-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download
memory/1296-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1296-63-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download