Overview

overview

7

Static

static

1

TGX no key...-1.exe

windows7-x64

7

TGX no key...-1.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    91s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2023, 02:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TGX no key - Linkvertise Downloader_YhElg-1.exe

  • Size

    8.1MB

  • MD5

    cc2822d11b222408b485f298382b3420

  • SHA1

    be833e57e3d7a6a56a087a1c3edc5b17b403a434

  • SHA256

    f5c1cd9948f48ea9c98b2e3c8332980661daa1fb495b09991a080c03b21e13de

  • SHA512

    53a5b863efabf65f0801d3ceb68a567828cf71c04ce086430fdc25d15b3985088792cad8a4488a9fa06206e74544572e7142a26fbc353f68c9deeb578161adbf

  • SSDEEP

    196608:h38JJEU16hTZl583S0LJu+mzfDkzUoXOM1ughyt7p:m1MlCC0Ybzf4zUoXN8Bp

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TGX no key - Linkvertise Downloader_YhElg-1.exe
    "C:\Users\Admin\AppData\Local\Temp\TGX no key - Linkvertise Downloader_YhElg-1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4332
    • C:\Users\Admin\AppData\Local\Temp\is-RM8NR.tmp\TGX no key - Linkvertise Downloader_YhElg-1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-RM8NR.tmp\TGX no key - Linkvertise Downloader_YhElg-1.tmp" /SL5="$D004E,7540945,1235456,C:\Users\Admin\AppData\Local\Temp\TGX no key - Linkvertise Downloader_YhElg-1.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-4OQFU.tmp\AppUtils.dll
    Filesize

    1.8MB

    MD5

    43ce6d593abd5141a3139603f352ae05

    SHA1

    a97c75e23d275dddfde15ef5fdf3ff3253c0992c

    SHA256

    94e874f2702ea6be50e7d74864b66e7f763449c3db237803f3fad6adfd64ed3d

    SHA512

    bfc527529e5f73ba190dfc5bd043175c7e2ae963b665d6d39421c29e025020f1d593dc88b7bee33d86ef6b4f7a4c5e1a0339df4e99cab6849a275d1dda9f439f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-4OQFU.tmp\botva2.dll
    Filesize

    37KB

    MD5

    67965a5957a61867d661f05ae1f4773e

    SHA1

    f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

    SHA256

    450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

    SHA512

    c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-4OQFU.tmp\botva2.dll
    Filesize

    37KB

    MD5

    67965a5957a61867d661f05ae1f4773e

    SHA1

    f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

    SHA256

    450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

    SHA512

    c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-RM8NR.tmp\TGX no key - Linkvertise Downloader_YhElg-1.tmp
    Filesize

    3.4MB

    MD5

    fbbad8149a1c6aed741101d3011757cb

    SHA1

    badef69a28b857fdd0b9859552736faba9e8886a

    SHA256

    d5f92ec4e4f095bea8fb56825333eaa6c3fb5e3b2dfc245bac058cdfb6cef4b8

    SHA512

    edc6d6cba79cc6d595cdc72f448189e9d5f5b0208c09bbfdd6344cd029848ec155e5aa744eac437a13f14f61b0297308b36df90b190a138e4c34aa8bb45d3b42

    Download Submit

  • memory/4312-140-0x0000000005580000-0x000000000558F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/4332-132-0x0000000000400000-0x000000000053B000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4332-134-0x0000000000400000-0x000000000053B000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4332-141-0x0000000000400000-0x000000000053B000-memory.dmp

    Filesize

    1.2MB

    Download