aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da

Analysis

max time kernel
502s
max time network
507s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2023, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da.exe
Size

1.7MB
MD5

4e60fbfb9f6c7e9fe6935437253038eb
SHA1

7c020f139905f97885970f05230d3d74f00e1be7
SHA256

aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da
SHA512

b7a7686992208935d21db965280a69f8e44062009c547125d71dcde809fde39fe49d5312bab3ff8bed685b1fdda3cefcfd3762dd941922f40879df0ada7468f2
SSDEEP

24576:P4nXubIQGyxbPV0db26WLzJ0mYK421t0YKbDVfcqOlsoO0drNBuLy1zoHf2MPyn:Pqe3f6WJx5leDlMlsRmpgtfKn

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4420	aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da.tmp

Loads dropped DLL 2 IoCs

pid	Process
4420	aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da.tmp
4420	aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4420	4384	aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da.exe	85
PID 4384 wrote to memory of 4420	4384	aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da.exe	85
PID 4384 wrote to memory of 4420	4384	aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da.exe	85

C:\Users\Admin\AppData\Local\Temp\aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da.exe
"C:\Users\Admin\AppData\Local\Temp\aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Users\Admin\AppData\Local\Temp\is-U345M.tmp\aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-U345M.tmp\aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da.tmp" /SL5="$501C2,874175,831488,C:\Users\Admin\AppData\Local\Temp\aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-FJVBG.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FJVBG.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U345M.tmp\aa9a73d984e82c7858082c43ce3872a2dcaa6be3f31ce2f012882983798ac9da.tmp

Filesize
3.0MB

MD5
0ee24b1e0f0078b25c512ec0e5c3e14d

SHA1
d292c7452b4417dfd2fc3094a58e8e9de917b513

SHA256
8288bfe42bf10dd76e709745317e4971283284e78c124d2d304543acb02a8e22

SHA512
416e50f5e2ff2cf34e7ab5cbbf7a522343b6b4669f09ea0a282e97005bdb861686bdff075ed58e27c392d4c1ff017aa67773863a4fd4981c40c7e61661d94b60

Download Submit
memory/4384-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4384-149-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4384-152-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4420-138-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/4420-145-0x0000000006970000-0x000000000697F000-memory.dmp

Filesize
60KB

Download
memory/4420-150-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download