2257b3fbe3c7559de8b31170155a433faf5b83829e67c589d5674ff086b868b9

Analysis

max time kernel
86s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2022 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VC_redist.x64.exe
Size

24.3MB
MD5

703bd677778f2a1ba1eb4338bac3b868
SHA1

a176f140e942920b777f80de89e16ea57ee32be8
SHA256

2257b3fbe3c7559de8b31170155a433faf5b83829e67c589d5674ff086b868b9
SHA512

a66ea382d8bdd31491627fd698242d2eda38b1d9df762c402923ef40bbca6aa2f43f22fa811c5fc894b529f9e77fcdd5ced9cd8af4a19f53845fce3780e8c041
SSDEEP

786432:tEp+Ty2SfUfnLZnvko+Me/ht8+0c4Nz55TOZHzqnIlh:yp+Ty2SfWnVvkodepC+05NbOZHzqnIlh

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
916	VC_redist.x64.exe

Loads dropped DLL 1 IoCs

pid	Process
916	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 916	3172	VC_redist.x64.exe	80
PID 3172 wrote to memory of 916	3172	VC_redist.x64.exe	80
PID 3172 wrote to memory of 916	3172	VC_redist.x64.exe	80

C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.exe
"C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\Temp\{53E22CBD-CB01-4BFD-89F1-9E5820060783}\.cr\VC_redist.x64.exe
  "C:\Windows\Temp\{53E22CBD-CB01-4BFD-89F1-9E5820060783}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{333EF806-AD1E-4EC3-8E65-8E5EE49118DB}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{53E22CBD-CB01-4BFD-89F1-9E5820060783}\.cr\VC_redist.x64.exe

Filesize
635KB

MD5
848da6b57cb8acc151a8d64d15ba383d

SHA1
8f4d4a1afa9fd985c67642213b3e7ccf415591da

SHA256
5a61f9775032457db28edd41f98f08c874e759f344ea8475c9ac8abbba68de12

SHA512
ff8b87e7746ecf19a150874dedd6ea4c51c76cfc291c5a80d9e5073a9bbbb2bd6ed7d10425b083578dc8d28d0d905e379fa3f919a60979e5b5c44ebc0ac613e6

Download Submit
C:\Windows\Temp\{53E22CBD-CB01-4BFD-89F1-9E5820060783}\.cr\VC_redist.x64.exe

Filesize
635KB

MD5
848da6b57cb8acc151a8d64d15ba383d

SHA1
8f4d4a1afa9fd985c67642213b3e7ccf415591da

SHA256
5a61f9775032457db28edd41f98f08c874e759f344ea8475c9ac8abbba68de12

SHA512
ff8b87e7746ecf19a150874dedd6ea4c51c76cfc291c5a80d9e5073a9bbbb2bd6ed7d10425b083578dc8d28d0d905e379fa3f919a60979e5b5c44ebc0ac613e6

Download Submit
memory/916-132-0x0000000000000000-mapping.dmp

Download