b072cd5dfe9bcdb08250fac0647e5040ca03ebfde85bc0083c7766d1cf9930c5

Analysis

max time kernel
150s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2023 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Papers Please De SmoggyBox7636/Papers Please -Survarium100/setup.exe
Size

828KB
MD5

051be444bb912b68b005a03d165e5328
SHA1

17d41f81d8bea23d43aab6830b852dd441a8e0ce
SHA256

6148ded4c2efae5064b48b331fbc4684421afeeb89bce849ebeace952c46572b
SHA512

d78a268e6e2db9b8c9d394dac1072bd001064e8c301a750fedf1a2e17df23bd4f1431de92c39e50e31dcd9bb0e1eba637d6b89d61ab7e68861767c43c91016c3
SSDEEP

12288:sjxolfRJjrQ94OQ/Z2/QPy22ScjY6YCnJUsQOA0q6HRHazuaWtQLH5/yl:sjKVbr44tRXa22SEY6YCqHOEVJp8

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

setup.tmp

pid process

4812 setup.tmp
Loads dropped DLL 2 IoCs

Processes:

setup.tmp

pid process

4812 setup.tmp
4812 setup.tmp

pid	process
4812	setup.tmp

pid	process
4812	setup.tmp
4812	setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

setup.exe

description	pid	process	target process
PID 1436 wrote to memory of 4812	1436	setup.exe	setup.tmp
PID 1436 wrote to memory of 4812	1436	setup.exe	setup.tmp
PID 1436 wrote to memory of 4812	1436	setup.exe	setup.tmp

C:\Users\Admin\AppData\Local\Temp\Papers Please De SmoggyBox7636\Papers Please -Survarium100\setup.exe
"C:\Users\Admin\AppData\Local\Temp\Papers Please De SmoggyBox7636\Papers Please -Survarium100\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Users\Admin\AppData\Local\Temp\is-GSEKU.tmp\setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-GSEKU.tmp\setup.tmp" /SL5="$E0060,436752,83968,C:\Users\Admin\AppData\Local\Temp\Papers Please De SmoggyBox7636\Papers Please -Survarium100\setup.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-GSEKU.tmp\setup.tmp
Filesize
923KB

MD5
6efab7ad87ecb5df6601a10c63b62a2c

SHA1
cd739a9ac81aedb8b88c8b9f03da10a2632cdddd

SHA256
97a772425f76e192adc79efb571cecdbf132066db6f6e8316bfb6c6ac4364b1b

SHA512
0341eeea4150e067a2e841d6bb8b587aec88c209f20f5730c1a502b2263c7ba0c95e6c63f91b3718d8bed88ea010e66b8102d44d9b3b0e8e51c9632897aba16b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GSEKU.tmp\setup.tmp
Filesize
923KB

MD5
6efab7ad87ecb5df6601a10c63b62a2c

SHA1
cd739a9ac81aedb8b88c8b9f03da10a2632cdddd

SHA256
97a772425f76e192adc79efb571cecdbf132066db6f6e8316bfb6c6ac4364b1b

SHA512
0341eeea4150e067a2e841d6bb8b587aec88c209f20f5730c1a502b2263c7ba0c95e6c63f91b3718d8bed88ea010e66b8102d44d9b3b0e8e51c9632897aba16b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OKJEU.tmp\ISDone.dll
Filesize
452KB

MD5
4feafa8b5e8cdb349125c8af0ac43974

SHA1
7f17e5e1b088fc73690888b215962fbcd395c9bd

SHA256
bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71

SHA512
d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OKJEU.tmp\ISDone.dll
Filesize
452KB

MD5
4feafa8b5e8cdb349125c8af0ac43974

SHA1
7f17e5e1b088fc73690888b215962fbcd395c9bd

SHA256
bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71

SHA512
d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc

Download Submit
memory/1436-133-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1436-152-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4812-148-0x0000000007260000-0x00000000072D7000-memory.dmp

Filesize
476KB

Download
memory/4812-151-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/4812-153-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/4812-154-0x0000000007260000-0x00000000072D7000-memory.dmp

Filesize
476KB

Download
memory/4812-160-0x0000000007260000-0x00000000072D7000-memory.dmp

Filesize
476KB

Download