c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b

Analysis

max time kernel
125s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
Size 376KB
Sample221204-rfv8daaf9x
SHA256 c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b
MD5 4d1d55a40680b9bd9914535eb9a03487
SHA1 4a6891c653054c3b0d46772b38d1bbaa88d3f3d8
SHA512 26be11ea4c98ebb9b9b096c9a98d6d83698c7cccb777a1a607c915ca01547644f6aa5c031d470fd0c4f764250d2885c4826224ecebe0ab2f78aa2cad67bf5538
SSDEEP 3072:gPF9AomKoezHosdmHHvsanYKmo9VovilPF9AorKoezHos0rGR5eKsBoV67g0J:gd9lXA5nlHVoqd9iXuMgRNMK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4960	rundll32.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\RCXB3C.tmp	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
File opened for modification	C:\Windows\SysWOW64\RCXB6C.tmp	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
File opened for modification	C:\Windows\SysWOW64\slive.exe	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
File opened for modification	C:\Windows\SysWOW64\RCXB6D.tmp	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
File opened for modification	C:\Windows\SysWOW64\RCXB6E.tmp	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
File opened for modification	C:\Windows\SysWOW64\searchlive.dll	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
File opened for modification	C:\Windows\SysWOW64\RCXB9F.tmp	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
File opened for modification	C:\Windows\SysWOW64\flive.dll	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
File opened for modification	C:\Windows\SysWOW64\RCXB1C.tmp	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
File opened for modification	C:\Windows\SysWOW64\RCXB9E.tmp	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
File opened for modification	C:\Windows\SysWOW64\RCXBAF.tmp	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
File opened for modification	C:\Windows\SysWOW64\RCXBC0.tmp	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4960	4388	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe	87
PID 4388 wrote to memory of 4960	4388	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe	87
PID 4388 wrote to memory of 4960	4388	c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe	87

C:\Users\Admin\AppData\Local\Temp\c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe
"C:\Users\Admin\AppData\Local\Temp\c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\rundll32.exe
  "rundll32.exe" searchlive.dll,DllUnregisterServer
  2⤵
  - Loads dropped DLL
  PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

flive.dll

Path C:\Windows\SysWOW64\flive.dll
Size 388KB
SHA256 0969c655781c8b42218e8ce9270a663fb419600d02cb1e90dec576b795a979d8
MD5 cc85e09aa847d86feeaa142abfe0c33f
SHA1 7abd1db0fe201976401fdbc3bca2590a23525c39
SHA512 7680c431249656c58dfe20a35969de8170ab7beb33dcae39a5d3fc7145f45be44d570639272aad5ff429379d4e076f50793d09cb3ce5848081eebdcc0150317a
SSDEEP 3072:jmHHvsanYKmo9V1dmHHvsanYKmo9VovilPF9AorKoezHos0rGR5eKsBoV67gvI:+5nlHV1A5nlHVoqd9iXuMgRNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

searchlive.dll

Path C:\Windows\SysWOW64\searchlive.dll
Size 372KB
SHA256 063e4ee176e8e45a377ba826284ae949032c0a258bf0d7132ab95ec1d77426c7
MD5 ede1e4d7eab39722b2c100a6542067f8
SHA1 015c370cf00b801818c20dc266211ccc4348a778
SHA512 ff958fd3f825483d0e0ed9c0444ee155c7f9c94e42b77614f8e2d6dabb0fecf17912603baa96c58615920d4885e108a75f41ff00109c56f0bb0b6c330396a5cd
SSDEEP 3072:GGR5eKsBoVVdmHHvsanYKmo9VovilPF9AorKoezHos0rGR5eKsBoV67g7+:GMgR+A5nlHVoqd9iXuMgRNMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

searchlive.dll

Path C:\Windows\SysWOW64\searchlive.dll
Size 372KB
SHA256 063e4ee176e8e45a377ba826284ae949032c0a258bf0d7132ab95ec1d77426c7
MD5 ede1e4d7eab39722b2c100a6542067f8
SHA1 015c370cf00b801818c20dc266211ccc4348a778
SHA512 ff958fd3f825483d0e0ed9c0444ee155c7f9c94e42b77614f8e2d6dabb0fecf17912603baa96c58615920d4885e108a75f41ff00109c56f0bb0b6c330396a5cd
SSDEEP 3072:GGR5eKsBoVVdmHHvsanYKmo9VovilPF9AorKoezHos0rGR5eKsBoV67g7+:GMgR+A5nlHVoqd9iXuMgRNMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

slive.exe

Path C:\Windows\SysWOW64\slive.exe
Size 376KB
SHA256 c6fc01cc6f683b5aa1b7a186f9f878abf20b29b7c47c9f0f9f8d82b0c41c5f7b
MD5 4d1d55a40680b9bd9914535eb9a03487
SHA1 4a6891c653054c3b0d46772b38d1bbaa88d3f3d8
SHA512 26be11ea4c98ebb9b9b096c9a98d6d83698c7cccb777a1a607c915ca01547644f6aa5c031d470fd0c4f764250d2885c4826224ecebe0ab2f78aa2cad67bf5538
SSDEEP 3072:gPF9AomKoezHosdmHHvsanYKmo9VovilPF9AorKoezHos0rGR5eKsBoV67g0J:gd9lXA5nlHVoqd9iXuMgRNMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads