Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2023 11:58
Static task
static1
Behavioral task
behavioral1
Sample
4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.exe
Resource
win7-20230220-en
General
-
Target
4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.exe
-
Size
2.2MB
-
MD5
21023659c520bac658fb70fea771afa5
-
SHA1
cc469d6cb1dfea8e1764ad3f7cbd1c998322951f
-
SHA256
4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48
-
SHA512
ff99ce7920aed560e62704a0c6811bed20d5a703826d4df931ae7d11f6ae331ffc9c801823bcad1db0790d447b5bb50a1e15d0216b2e226fe93b823fc3a3370e
-
SSDEEP
49152:d24/iTDy7s9PAY6w83m3R2HO7jo5wcSZmI/m/WahOVLT3Mk:Imi/yw9PAYT83mB286n/JhOVL7Mk
Malware Config
Extracted
gcleaner
45.139.105.171
85.31.46.167
107.182.129.235
171.22.30.106
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmpHitFiles134.exeIJvSMN.exepid process 848 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp 4388 HitFiles134.exe 4672 IJvSMN.exe -
Loads dropped DLL 1 IoCs
Processes:
4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmppid process 848 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 17 IoCs
Processes:
4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmpdescription ioc process File created C:\Program Files (x86)\Split Files\language\is-BMAT1.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\is-HMVSE.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\is-A78FO.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\language\is-1EJTL.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\language\is-CULSS.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\language\is-MR8L5.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\language\is-5F7DP.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\unins000.dat 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\language\is-N48MT.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\language\is-5TALS.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\language\is-9PK8P.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\is-2E5GJ.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\is-QT95U.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File opened for modification C:\Program Files (x86)\Split Files\unins000.dat 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File opened for modification C:\Program Files (x86)\Split Files\HitFiles134.exe 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\is-6JP50.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp File created C:\Program Files (x86)\Split Files\language\is-F8S8O.tmp 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
HitFiles134.exepid process 4388 HitFiles134.exe 4388 HitFiles134.exe 4388 HitFiles134.exe 4388 HitFiles134.exe 4388 HitFiles134.exe 4388 HitFiles134.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
HitFiles134.exepid process 4388 HitFiles134.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.exe4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmpHitFiles134.exedescription pid process target process PID 3728 wrote to memory of 848 3728 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.exe 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp PID 3728 wrote to memory of 848 3728 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.exe 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp PID 3728 wrote to memory of 848 3728 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.exe 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp PID 848 wrote to memory of 4388 848 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp HitFiles134.exe PID 848 wrote to memory of 4388 848 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp HitFiles134.exe PID 848 wrote to memory of 4388 848 4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp HitFiles134.exe PID 4388 wrote to memory of 4672 4388 HitFiles134.exe IJvSMN.exe PID 4388 wrote to memory of 4672 4388 HitFiles134.exe IJvSMN.exe PID 4388 wrote to memory of 4672 4388 HitFiles134.exe IJvSMN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.exe"C:\Users\Admin\AppData\Local\Temp\4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MQP79.tmp\4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp"C:\Users\Admin\AppData\Local\Temp\is-MQP79.tmp\4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmp" /SL5="$9002E,1803570,162304,C:\Users\Admin\AppData\Local\Temp\4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Split Files\HitFiles134.exe"C:\Program Files (x86)\Split Files\HitFiles134.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{0338073a-b1a2-11ed-9ee7-806e6f6e6963}\IJvSMN.exe
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Split Files\HitFiles134.exeFilesize
3.4MB
MD5a5dd7b002ebf956ad08da564d0afe528
SHA1bf3f1177e016a5cbdb3ee09b0f8e1f86e70cee63
SHA2568a27e39847699e08a9056beb2f53b25ae64591ba77cc8413a7b08071eac8e504
SHA512fb0cb8dcb9b6ee2898d0ba2dcc06bfa43819832633c35a0490ecd6e63e8f0e561636f5540cf62eb7d71e69e9bce15ea7ce97f2f8d512fcc423eea7d638e3f82b
-
C:\Program Files (x86)\Split Files\HitFiles134.exeFilesize
3.4MB
MD5a5dd7b002ebf956ad08da564d0afe528
SHA1bf3f1177e016a5cbdb3ee09b0f8e1f86e70cee63
SHA2568a27e39847699e08a9056beb2f53b25ae64591ba77cc8413a7b08071eac8e504
SHA512fb0cb8dcb9b6ee2898d0ba2dcc06bfa43819832633c35a0490ecd6e63e8f0e561636f5540cf62eb7d71e69e9bce15ea7ce97f2f8d512fcc423eea7d638e3f82b
-
C:\Users\Admin\AppData\Local\Temp\is-0AM1N.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
C:\Users\Admin\AppData\Local\Temp\is-MQP79.tmp\4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmpFilesize
800KB
MD57013a53c5472267941844ed17de4de3c
SHA1dda886aa81995da2abb763969bba86e82988db1a
SHA2569897aed9da44b8a3c7d7cdeac2fdf2281bcd024846c77d45bc84b973abddc81e
SHA5126b1e8845ffeda2a775370a89aaf7e7477cd6264df15da3cc7e412c282e0ccfb3719d6b08fc65190e61ec9674f5f527d939d9cd50ff9f29af37a049d04596060d
-
C:\Users\Admin\AppData\Local\Temp\is-MQP79.tmp\4138137b8f7935b1bfb24c1d65a1da491ae9d717dc173e2614edd69e0aa69e48.tmpFilesize
800KB
MD57013a53c5472267941844ed17de4de3c
SHA1dda886aa81995da2abb763969bba86e82988db1a
SHA2569897aed9da44b8a3c7d7cdeac2fdf2281bcd024846c77d45bc84b973abddc81e
SHA5126b1e8845ffeda2a775370a89aaf7e7477cd6264df15da3cc7e412c282e0ccfb3719d6b08fc65190e61ec9674f5f527d939d9cd50ff9f29af37a049d04596060d
-
C:\Users\Admin\AppData\Roaming\{0338073a-b1a2-11ed-9ee7-806e6f6e6963}\IJvSMN.exeFilesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
-
C:\Users\Admin\AppData\Roaming\{0338073a-b1a2-11ed-9ee7-806e6f6e6963}\IJvSMN.exeFilesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
-
memory/848-176-0x0000000002350000-0x0000000002351000-memory.dmpFilesize
4KB
-
memory/848-189-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3728-133-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3728-188-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4388-182-0x0000000000400000-0x000000000155F000-memory.dmpFilesize
17.4MB
-
memory/4388-183-0x0000000000400000-0x000000000155F000-memory.dmpFilesize
17.4MB
-
memory/4388-190-0x0000000000400000-0x000000000155F000-memory.dmpFilesize
17.4MB