d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
Size

11.7MB
MD5

a5c82f605e7396aeb4dd0bac30c89a20
SHA1

d1ddcb913d4fd1a20ffb87a1770ef807d438ba61
SHA256

d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b
SHA512

75ca19b46db223284d8582d28e7607b8a3e8aeba5825ade0293cbfc514a821eabd0fd9e3b94a19d457f5c23f9362422e4439e22daa01817f69d737840ad6a958
SSDEEP

196608:n5IElqYg5DlRNqeyTmYwegPgKX61Jes1899ir5WruTjFW3bMn6EJDggxqY+g4Ez5:zg5zpywjPlK7epmr/3n6vLEzOg

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4904	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
4904	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
4904	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wmspdmvoe.exe	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File opened for modification	C:\Windows\SysWOW64\atkctfxs.dll	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File created	C:\Windows\SysWOW64\~GLH0007.TMP	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File created	C:\Windows\SysWOW64\~GLH0009.TMP	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File opened for modification	C:\Windows\SysWOW64\imjmipg.exe	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File created	C:\Windows\SysWOW64\GLBSINST.%$D	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File opened for modification	C:\Windows\SysWOW64\compactqd.dll	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File opened for modification	C:\Windows\SysWOW64\gcdb_file.dsn	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File created	C:\Windows\SysWOW64\~GLH0004.TMP	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File opened for modification	C:\Windows\SysWOW64\ocftache.dll	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File created	C:\Windows\SysWOW64\~GLH0006.TMP	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File opened for modification	C:\Windows\SysWOW64\asctrlxcs.dll	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File created	C:\Windows\SysWOW64\~GLH0008.TMP	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File created	C:\Windows\SysWOW64\~GLH0002.TMP	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File created	C:\Windows\SysWOW64\~GLH0003.TMP	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File created	C:\Windows\SysWOW64\~GLH0005.TMP	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File created	C:\Windows\SysWOW64\~GLH000a.TMP	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File opened for modification	C:\Windows\SysWOW64\atraxce.dat	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
File opened for modification	C:\Windows\SysWOW64\ieapfxlyt.dll	d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe

C:\Users\Admin\AppData\Local\Temp\d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe
"C:\Users\Admin\AppData\Local\Temp\d5cfe789b6734188a35d172b4858b3b02a1c31041b440453bb7cfb7e41a8dc7b.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:4904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GLC961A.tmp

Filesize
161KB

MD5
8c97d8bb1470c6498e47b12c5a03ce39

SHA1
15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7

SHA256
a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a

SHA512
7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\GLK984F.tmp

Filesize
30KB

MD5
bf19c2106c989ae74e5baa852ebfa9f0

SHA1
d00db9273968447dfa4bd57ed8dab6b6d35246bd

SHA256
7bcb23195837b5dbee6764cba6234a15f9e313da93bed918d7a9b4fa20f3a092

SHA512
3c9803550ff85dc01aea8131c8ca68f7d6731fb6f927effad6494142640a58595107cdd8361b7190ac6de9eda95da29a85fa12074d6ad668b65c4e118a301e21

Download Submit
C:\Users\Admin\AppData\Local\Temp\GLK984F.tmp

Filesize
30KB

MD5
bf19c2106c989ae74e5baa852ebfa9f0

SHA1
d00db9273968447dfa4bd57ed8dab6b6d35246bd

SHA256
7bcb23195837b5dbee6764cba6234a15f9e313da93bed918d7a9b4fa20f3a092

SHA512
3c9803550ff85dc01aea8131c8ca68f7d6731fb6f927effad6494142640a58595107cdd8361b7190ac6de9eda95da29a85fa12074d6ad668b65c4e118a301e21

Download Submit
memory/4904-135-0x0000000002321000-0x0000000002323000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads