Analysis
-
max time kernel
150s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-11-2022 08:22
General
-
Target
Unlocker Setup v1.exe
-
Size
2.3MB
-
MD5
8434d94b119c2f67c204e70b96616547
-
SHA1
835346733f82025e000adad7e600a0c5fe803f58
-
SHA256
0b79a057c63ae780bf99e7bf4b165c8fe2edf1e7aa0d6bb4d6c2646cbd598bbb
-
SHA512
a8b7e854c56f023b9cd9add640e58e8f2108d59d0a3da8ada16596f69a9e0d928037e8ad96a90b233d9fee2c1703276cc17995160fda708ac738bd1174396768
-
SSDEEP
49152:NnedYpANz/Jnxmh1E4gzw/sj9KiRaYHEdqkIU5x8ZL9oH4K8Ao5q7:MdYWNlxOu4gc/2QKa6aDIpZLdK8bW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Unlocker Setup v1.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker Setup v1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-P26HN.tmp\Unlocker Setup v1.tmp"C:\Users\Admin\AppData\Local\Temp\is-P26HN.tmp\Unlocker Setup v1.tmp" /SL5="$90068,1921177,161280,C:\Users\Admin\AppData\Local\Temp\Unlocker Setup v1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-P26HN.tmp\Unlocker Setup v1.tmpFilesize
1.1MB
MD519a6af009ae2158193840fad0beb35a5
SHA122fa52840999897ce7c43606d3e77218a017d55a
SHA25669a2b348be8dc8aa309005ce8acbcb3945159e4286ea3cbd054243804da7e7c4
SHA5127abc6299980ef0b9bfc413710c26e9acc099fbd2acac41dc92e9a6e18839beef9b705b3cc031c92ccd888f1fe74c19f1db48180039491bc40e7bbf82672e2232
-
C:\Users\Admin\AppData\Local\Temp\is-P26HN.tmp\Unlocker Setup v1.tmpFilesize
1.1MB
MD519a6af009ae2158193840fad0beb35a5
SHA122fa52840999897ce7c43606d3e77218a017d55a
SHA25669a2b348be8dc8aa309005ce8acbcb3945159e4286ea3cbd054243804da7e7c4
SHA5127abc6299980ef0b9bfc413710c26e9acc099fbd2acac41dc92e9a6e18839beef9b705b3cc031c92ccd888f1fe74c19f1db48180039491bc40e7bbf82672e2232
-
C:\Users\Admin\AppData\Local\Temp\is-Q3647.tmp\IObitUnlocker.dllFilesize
71KB
MD51477ad19ca227dde663a33dc0e840329
SHA19ad8d2ff29488b2c6c037ebf730d72b71bde0e62
SHA256adafa3d25242a671ea0d07c1103aca110b737bae8e29d8975bea35267feab657
SHA512f2a523eef506b6b06aa664580a3696b3cffe0172289f3603d61d0f864992ed03de4392cec679cd510ec801bde9d0c2c0dd885a87a55726c6a45e72f075069f90
-
memory/920-134-0x0000000000000000-mapping.dmp
-
memory/3604-132-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3604-137-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB