52bbb9086d5e454b3606b20aaaf380c623f700d529fb6da788ffce78432d7d07

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2023, 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

utweb_installer.exe
Size

1.7MB
MD5

f4f238302d3529b21c6a8bf9ed4f5276
SHA1

c192e6a15db8f12a7a70e15477a5d984f581472f
SHA256

52bbb9086d5e454b3606b20aaaf380c623f700d529fb6da788ffce78432d7d07
SHA512

b587536d547a1186bd1d74ffb61675a1c1a3c67ca20e694eab94ba6f58fcf278a077c3b9598c9054807394439b8af94831686b4a233ed410814c4fd509b17a62
SSDEEP

24576:P4nXubIQGyxbPV0db26wQeNuwWWAmCdqotxoBcXRGEtLi+F/WY4O5bI:Pqe3f60vxWlmCdqogBcvhtle

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4832	utweb_installer.tmp

Loads dropped DLL 2 IoCs

pid	Process
4832	utweb_installer.tmp
4832	utweb_installer.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 4832	5060	utweb_installer.exe	85
PID 5060 wrote to memory of 4832	5060	utweb_installer.exe	85
PID 5060 wrote to memory of 4832	5060	utweb_installer.exe	85

C:\Users\Admin\AppData\Local\Temp\utweb_installer.exe
"C:\Users\Admin\AppData\Local\Temp\utweb_installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\is-MPH6D.tmp\utweb_installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MPH6D.tmp\utweb_installer.tmp" /SL5="$1A0022,897614,818688,C:\Users\Admin\AppData\Local\Temp\utweb_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-LJ8AJ.tmp\Logo.png

Filesize
12KB

MD5
a00cfe887e254c462ad0c6a6d3fb25b6

SHA1
c603a192e23df46c719febf07fd4207c96b1f0f9

SHA256
bca0271f56f7384942ff3affb79fa78ccdceabf7dda89ad3c138226da324cdb1

SHA512
6dc95a05e2712d85067aa92144f7e00871d2f60e377c6df0253e3ff48a02280d4148578fbbf22018693227bdcc035a8bd391f3c390aed39ca58749f28fc19862

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LJ8AJ.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LJ8AJ.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MPH6D.tmp\utweb_installer.tmp

Filesize
3.0MB

MD5
e09f4c0fbeda6c07ced22ed0e1206fff

SHA1
8c5b35af00edb742aa5bee8172ef7c880609ffda

SHA256
78f50d6fdff01abe6cfb9cbcea33e5c272aa5f3ed7363ca16fa9c2859a8297d4

SHA512
ea66e066f44b62fb5c0aa0601a6bf43b9ca21d884811fd3de6ca9e9f75f856debd6f98080a41490ac2602c5d8deebda09e370ec8d09a554d1550dbf3a958509e

Download Submit
memory/4832-138-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/4832-148-0x00000000052D0000-0x00000000052DF000-memory.dmp

Filesize
60KB

Download
memory/4832-155-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/4832-156-0x00000000052D0000-0x00000000052DF000-memory.dmp

Filesize
60KB

Download
memory/4832-157-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/5060-133-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/5060-154-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download