Analysis

  • max time kernel
    202s
  • max time network
    233s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 12:15 UTC

General

  • Target

    sims3_holly_iso_tfile_ru.exe

  • Size

    507KB

  • MD5

    e26b60bca50fcd0bb4ec8130f408a9fc

  • SHA1

    0456f4d4abf68b34eede33aec933711cfa13ddcf

  • SHA256

    e89565bc13b10928ea4645be724ef4e7ef385ed4dd192af37b16ba7e6911b3df

  • SHA512

    88f3244bd57b62bd58b195e51579d04cf4867516bbe261801c2bf7f6e9b41773b353eae5fe1c783f3eaa214ed9f7fed11632433341bd168125d14d6a4fad326c

  • SSDEEP

    12288:OvsNu9dz7eZG9bLoaFUMAmGzMlbz47VmgW:+19dXDbr+mGzMlb8Vi

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sims3_holly_iso_tfile_ru.exe
    "C:\Users\Admin\AppData\Local\Temp\sims3_holly_iso_tfile_ru.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Users\Admin\AppData\Local\Temp\sims3_holly_iso_tfile_ru.exe
      start
      2⤵
        PID:4328
      • C:\Users\Admin\AppData\Local\Temp\sims3_holly_iso_tfile_ru.exe
        watch
        2⤵
          PID:3972

      Network

      • flag-unknown
        DNS
        176.122.125.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        176.122.125.40.in-addr.arpa
        IN PTR
        Response
      • flag-unknown
        DNS
        forces.halftrade.ru
        sims3_holly_iso_tfile_ru.exe
        Remote address:
        8.8.8.8:53
        Request
        forces.halftrade.ru
        IN A
        Response
      • flag-unknown
        DNS
        forces.halftrade.ru
        sims3_holly_iso_tfile_ru.exe
        Remote address:
        8.8.8.8:53
        Request
        forces.halftrade.ru
        IN A
        Response
      • flag-unknown
        DNS
        0.e.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
        Remote address:
        8.8.8.8:53
        Request
        0.e.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
        IN PTR
        Response
      • 20.189.173.4:443
        322 B
        7
      • 40.126.32.76:443
        260 B
        5
      • 67.27.154.126:80
        322 B
        7
      • 96.16.53.137:80
        322 B
        7
      • 104.80.225.205:443
        322 B
        7
      • 8.8.8.8:53
        176.122.125.40.in-addr.arpa
        dns
        73 B
        159 B
        1
        1

        DNS Request

        176.122.125.40.in-addr.arpa

      • 8.8.8.8:53
        forces.halftrade.ru
        dns
        sims3_holly_iso_tfile_ru.exe
        65 B
        126 B
        1
        1

        DNS Request

        forces.halftrade.ru

      • 8.8.8.8:53
        forces.halftrade.ru
        dns
        sims3_holly_iso_tfile_ru.exe
        65 B
        126 B
        1
        1

        DNS Request

        forces.halftrade.ru

      • 8.8.8.8:53
        0.e.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
        dns
        118 B
        204 B
        1
        1

        DNS Request

        0.e.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2764-132-0x0000000000400000-0x0000000000484000-memory.dmp

        Filesize

        528KB

      • memory/2764-135-0x0000000000400000-0x0000000000484000-memory.dmp

        Filesize

        528KB

      • memory/3972-137-0x0000000000400000-0x0000000000484000-memory.dmp

        Filesize

        528KB

      • memory/3972-139-0x0000000000400000-0x0000000000484000-memory.dmp

        Filesize

        528KB

      • memory/4328-136-0x0000000000400000-0x0000000000484000-memory.dmp

        Filesize

        528KB

      • memory/4328-138-0x0000000000400000-0x0000000000484000-memory.dmp

        Filesize

        528KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.