Analysis
-
max time kernel
42s -
max time network
96s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:46
Static task
static1
Behavioral task
behavioral1
Sample
0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe
Resource
win10v2004-20220812-en
General
-
Target
0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe
-
Size
3.1MB
-
MD5
d81320cd418dbe42aacf308607347ec8
-
SHA1
3189453a28c49ec89addc8785a1fc0d7b3240916
-
SHA256
0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a
-
SHA512
82bee1e7afa1abeca09823e10c8f002d41faba753429e00b2a49123fb552c7bdf6b87a4ce61aab96dcf207c6f2e385329726cbda897dfe5d49d40c3a5dc305cb
-
SSDEEP
49152:P9hXDAkIZWnZDWCLW6tVlaqr2aV0KFvLHqgvkubUcPT8CX13eIOA1UGLuzoxp9/v:1hTAnQnZaCbFr2SPvugMuJPT8W13lIoT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmppid process 1900 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp -
Loads dropped DLL 3 IoCs
Processes:
0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmppid process 1188 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe 1900 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp 1900 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exedescription pid process target process PID 1188 wrote to memory of 1900 1188 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp PID 1188 wrote to memory of 1900 1188 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp PID 1188 wrote to memory of 1900 1188 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp PID 1188 wrote to memory of 1900 1188 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp PID 1188 wrote to memory of 1900 1188 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp PID 1188 wrote to memory of 1900 1188 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp PID 1188 wrote to memory of 1900 1188 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe"C:\Users\Admin\AppData\Local\Temp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\is-KRVG7.tmp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp"C:\Users\Admin\AppData\Local\Temp\is-KRVG7.tmp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp" /SL5="$60124,2987795,56832,C:\Users\Admin\AppData\Local\Temp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-KRVG7.tmp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmpFilesize
693KB
MD5bad7df2b3f5e2bdaf7c818b336d04c07
SHA14a7b408980f60d5f55939474481991673d1eca90
SHA256741b1212ab966ab11965c7401c46568839a8f806a3860f10ee3525ce5eab152c
SHA512e543d9686c89b584fc612d0b6356f8ed4650ff19b08c6f2e7367b5d9ace6ff9e6d9e35ecd1b589b252beba3425819517c58649003031c50de34a67dba24195e6
-
\Users\Admin\AppData\Local\Temp\is-KRVG7.tmp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmpFilesize
693KB
MD5bad7df2b3f5e2bdaf7c818b336d04c07
SHA14a7b408980f60d5f55939474481991673d1eca90
SHA256741b1212ab966ab11965c7401c46568839a8f806a3860f10ee3525ce5eab152c
SHA512e543d9686c89b584fc612d0b6356f8ed4650ff19b08c6f2e7367b5d9ace6ff9e6d9e35ecd1b589b252beba3425819517c58649003031c50de34a67dba24195e6
-
\Users\Admin\AppData\Local\Temp\is-TLCQM.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-TLCQM.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
memory/1188-54-0x0000000075091000-0x0000000075093000-memory.dmpFilesize
8KB
-
memory/1188-55-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1188-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1188-64-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1900-59-0x0000000000000000-mapping.dmp