Overview

overview

8

Static

static

SecuriteIn...45.exe

windows7-x64

8

SecuriteIn...45.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    157s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/01/2023, 12:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Win32.Adware.OpenCandy.P.30589.445.exe
  • Size 1.2MB
  • Sample230118-p2f98shb44
  • SHA256 04b635cd65aa68c51fd4ad0a94d3f42cbd4485dd535e4c8c50166fd2addc7bef
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Adware.OpenCandy.P.30589.445.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Adware.OpenCandy.P.30589.445.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3672
    • C:\Users\Admin\AppData\Local\Temp\is-S1BP3.tmp\SecuriteInfo.com.Win32.Adware.OpenCandy.P.30589.445.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-S1BP3.tmp\SecuriteInfo.com.Win32.Adware.OpenCandy.P.30589.445.tmp" /SL5="$C0048,977147,56832,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Adware.OpenCandy.P.30589.445.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Windows\SysWOW64\RunDll32.exe
        RunDll32.exe "C:\Users\Admin\AppData\Local\Temp\is-SVG9O.tmp\OCSetupHlp.dll",_OCPID1219OpenCandy2@16 5044,B64524C37F6540D7BB7FA3D893A7700D,24ADAE842CD14B059E6E125EF5408327,67B0E59D101C408FA3C8CB4C624A57C5
        3⤵
        • Loads dropped DLL
        PID:4924

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        SecuriteInfo.com.Win32.Adware.OpenCandy.P.30589.445.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-S1BP3.tmp\SecuriteInfo.com.Win32.Adware.OpenCandy.P.30589.445.tmp
        • Size 691KB
        • SHA256 bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SecuriteInfo.com.Win32.Adware.OpenCandy.P.30589.445.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-S1BP3.tmp\SecuriteInfo.com.Win32.Adware.OpenCandy.P.30589.445.tmp
        • Size 691KB
        • SHA256 bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        OCSetupHlp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-SVG9O.tmp\OCSetupHlp.dll
        • Size 825KB
        • SHA256 b2ed8800a9d78a0750d06b49e0f197aa284bca89179d6146ee189a1415c8abd4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        OCSetupHlp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-SVG9O.tmp\OCSetupHlp.dll
        • Size 825KB
        • SHA256 b2ed8800a9d78a0750d06b49e0f197aa284bca89179d6146ee189a1415c8abd4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        OCSetupHlp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-SVG9O.tmp\OCSetupHlp.dll
        • Size 825KB
        • SHA256 b2ed8800a9d78a0750d06b49e0f197aa284bca89179d6146ee189a1415c8abd4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3672-132-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/3672-134-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/3672-142-0x0000000000400000-0x0000000000414000-memory.dmp
        Download