Overview

overview

8

Static

static

Install Am...1).exe

windows7-x64

8

Install Am...1).exe

windows10-2004-x64

8

Analysis

  • max time kernel
    91s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2022, 17:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    Install AmpliTube 5 (Ver. 5.0.1).exe

  • Size

    1.6MB

  • MD5

    90c1695c260b0f35864197e09fe77e4a

  • SHA1

    03856e1e06f4dd5c6b057e4d434b3983648d3fef

  • SHA256

    0f16005b520225a06ab217526c68b4901eb625dc8173283cf655a62193022e06

  • SHA512

    d6814421b0aafd7a1e9c83e9fd573f86a942b4347a25bcf38859e4938931f1267ecc79fed2dba1044e89e37f0b3dac12a971a4ca73b0635f542b856a06c9c95c

  • SSDEEP

    24576:LTfEsP85DgJrivY05+QaYvPUZ/DDvmyXJQlWfZeik+wsud343HWAgjnEuIzSG:XcsQ6QEgs9udI3WA2n5fG

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Install AmpliTube 5 (Ver. 5.0.1).exe
    "C:\Users\Admin\AppData\Local\Temp\Install AmpliTube 5 (Ver. 5.0.1).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Users\Admin\AppData\Local\Temp\is-JRAVC.tmp\Install AmpliTube 5 (Ver. 5.0.1).tmp
      "C:\Users\Admin\AppData\Local\Temp\is-JRAVC.tmp\Install AmpliTube 5 (Ver. 5.0.1).tmp" /SL5="$80048,721408,0,C:\Users\Admin\AppData\Local\Temp\Install AmpliTube 5 (Ver. 5.0.1).exe"
      2⤵
      • Executes dropped EXE
      PID:3632

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\is-JRAVC.tmp\Install AmpliTube 5 (Ver. 5.0.1).tmp
          Filesize

          2.4MB

          MD5

          84db4b4205f705da71471dc6ecc061f5

          SHA1

          b90bac8c13a1553d58feef95a2c41c64118b29cf

          SHA256

          647983ebde53e0501ff1af8ef6190dfeea5ccc64caf7dce808f1e3d98fb66a3c

          SHA512

          c5803b63d33bb409433b496b83ca2a7359b4b1835815386206283b3af5c54d7d1cb9e80244a888638c7703c4bf54e1b2c11be6836f20b9fea157ab92bfbf365a

          Download Submit

        • memory/2840-132-0x0000000000400000-0x00000000004BE000-memory.dmp

          Filesize

          760KB

          Download

        • memory/2840-134-0x0000000000400000-0x00000000004BE000-memory.dmp

          Filesize

          760KB

          Download

        • memory/2840-137-0x0000000000400000-0x00000000004BE000-memory.dmp

          Filesize

          760KB

          Download