Analysis
-
max time kernel
51s -
max time network
180s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
22-03-2023 11:31
Static task
static1
Behavioral task
behavioral1
Sample
Unconfirmed 298696.exe
Resource
win10-20230220-en
General
-
Target
Unconfirmed 298696.exe
-
Size
1.7MB
-
MD5
99a9fbd5fee72ce51585309390a46717
-
SHA1
ff39c56312090a909c2c0c82629c552a3b252a98
-
SHA256
833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa
-
SHA512
97f9a98fb48c8281818163d3dbe66fa246e1fe6a5a67f15175419992b0ca389cbe086e457177c21ce9c99ff05a1e0b508812cdf30220090a438dd8c94f73c6b7
-
SSDEEP
24576:R4nXubIQGyxbPV0db26Wmd0l4sv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdO7:Rqe3f61mZSffPMWrQ0ZkA
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
Unconfirmed 298696.tmpfile_.exefile_.tmppid process 4108 Unconfirmed 298696.tmp 3528 file_.exe 3080 file_.tmp -
Loads dropped DLL 3 IoCs
Processes:
file_.tmppid process 3080 file_.tmp 3080 file_.tmp 3080 file_.tmp -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 5 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Unconfirmed 298696.tmppid process 4108 Unconfirmed 298696.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Unconfirmed 298696.exeUnconfirmed 298696.tmpfile_.exedescription pid process target process PID 1716 wrote to memory of 4108 1716 Unconfirmed 298696.exe Unconfirmed 298696.tmp PID 1716 wrote to memory of 4108 1716 Unconfirmed 298696.exe Unconfirmed 298696.tmp PID 1716 wrote to memory of 4108 1716 Unconfirmed 298696.exe Unconfirmed 298696.tmp PID 4108 wrote to memory of 3528 4108 Unconfirmed 298696.tmp file_.exe PID 4108 wrote to memory of 3528 4108 Unconfirmed 298696.tmp file_.exe PID 4108 wrote to memory of 3528 4108 Unconfirmed 298696.tmp file_.exe PID 3528 wrote to memory of 3080 3528 file_.exe file_.tmp PID 3528 wrote to memory of 3080 3528 file_.exe file_.tmp PID 3528 wrote to memory of 3080 3528 file_.exe file_.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\Unconfirmed 298696.exe"C:\Users\Admin\AppData\Local\Temp\Unconfirmed 298696.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-COPMI.tmp\Unconfirmed 298696.tmp"C:\Users\Admin\AppData\Local\Temp\is-COPMI.tmp\Unconfirmed 298696.tmp" /SL5="$A01E2,831488,831488,C:\Users\Admin\AppData\Local\Temp\Unconfirmed 298696.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-98FBE.tmp\file_.exe"C:\Users\Admin\AppData\Local\Temp\is-98FBE.tmp\file_.exe" /LANG=en /NA=Rh85hR643⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CFNL9.tmp\file_.tmp"C:\Users\Admin\AppData\Local\Temp\is-CFNL9.tmp\file_.tmp" /SL5="$201FE,1559708,780800,C:\Users\Admin\AppData\Local\Temp\is-98FBE.tmp\file_.exe" /LANG=en /NA=Rh85hR644⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-98FBE.tmp\file_.exeFilesize
2.3MB
MD5b428b88f130ea6bb7b3de7feed16d950
SHA13a4b9d68ad8b1814ef6563fb717921e17aefff2c
SHA2566b902e89dfd90e43fb134f8544d1794298199ee20075c0a35d89d67a4f1664da
SHA5121d7fd7e5a39eb2b1b8a692e48cf09b3e59419e363bc7f64c26bb97239760ac06173d06f814369a3fa28a697dd5180582d809409a61b47e7429157ae823281fb0
-
C:\Users\Admin\AppData\Local\Temp\is-98FBE.tmp\file_.exeFilesize
2.3MB
MD5b428b88f130ea6bb7b3de7feed16d950
SHA13a4b9d68ad8b1814ef6563fb717921e17aefff2c
SHA2566b902e89dfd90e43fb134f8544d1794298199ee20075c0a35d89d67a4f1664da
SHA5121d7fd7e5a39eb2b1b8a692e48cf09b3e59419e363bc7f64c26bb97239760ac06173d06f814369a3fa28a697dd5180582d809409a61b47e7429157ae823281fb0
-
C:\Users\Admin\AppData\Local\Temp\is-CFNL9.tmp\file_.tmpFilesize
2.9MB
MD5623a3abd7b318e1f410b1e12a42c7b71
SHA188e34041850ec4019dae469adc608e867b936d21
SHA256fe1a4555d18617532248d2eaa8d3fcc2c74182f994a964a62cf418295e8554d3
SHA5129afea88e4617e0f11416c2a2c416a6aa2d5d1f702d98d2cc223b399736191a6d002d1b717020ca6aae09e835c6356b7ddafad71e101dacab15967d89a105e391
-
C:\Users\Admin\AppData\Local\Temp\is-COPMI.tmp\Unconfirmed 298696.tmpFilesize
3.0MB
MD50c229cd26910820581b5809c62fe5619
SHA128c0630385b21f29e3e2bcc34865e5d15726eaa0
SHA256abfa49a915d2e0a82561ca440365e6a2d59f228533b56a8f78addf000a1081b3
SHA512b8ff3dc65f7c0e03721572af738ec4886ba895dc70c1a41a3ce8c8abe0946d167cec71913017fd11d5892452db761ea88901a5a09a681ae779dd531edbb83a2a
-
\Users\Admin\AppData\Local\Temp\is-DGPNB.tmp\Helper.dllFilesize
2.0MB
MD54eb0347e66fa465f602e52c03e5c0b4b
SHA1fdfedb72614d10766565b7f12ab87f1fdca3ea81
SHA256c73e53cbb7b98feafe27cc7de8fdad51df438e2235e91891461c5123888f73cc
SHA5124c909a451059628119f92b2f0c8bcd67b31f63b57d5339b6ce8fd930be5c9baf261339fdd9da820321be497df8889ce7594b7bfaadbaa43c694156651bf6c1fd
-
\Users\Admin\AppData\Local\Temp\is-DGPNB.tmp\botva2.dllFilesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
\Users\Admin\AppData\Local\Temp\is-DGPNB.tmp\botva2.dllFilesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
memory/1716-133-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1716-116-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1716-147-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3080-138-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/3080-156-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/3080-151-0x000000000AB90000-0x000000000AB9F000-memory.dmpFilesize
60KB
-
memory/3528-158-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/3528-127-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/4108-134-0x0000000000400000-0x000000000071A000-memory.dmpFilesize
3.1MB
-
memory/4108-145-0x0000000000400000-0x000000000071A000-memory.dmpFilesize
3.1MB
-
memory/4108-144-0x0000000002770000-0x0000000002771000-memory.dmpFilesize
4KB
-
memory/4108-121-0x0000000002770000-0x0000000002771000-memory.dmpFilesize
4KB