7d0f7d4dd28130bf130a16fc125a37e7fa4f56900fad7f02fadcf609788d1948

Analysis

max time kernel
78s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Project Script - Linkvertise Downloader_I1-gKu1.exe
Size

10.8MB
MD5

9ef88d8681a8606d5572078acfef47d5
SHA1

7d78745444359b634c1fd8f0c4f5bcc11a601daf
SHA256

7d0f7d4dd28130bf130a16fc125a37e7fa4f56900fad7f02fadcf609788d1948
SHA512

f9106049cf41fe67f1e97f1eb12bbb4a3c4dfc72252893aca3413c305ee62210b416d1ad160bf0c9b9a1313e404a406e400f74d3d49b13c0d0d5d363b8cc0ba5
SSDEEP

196608:R38JJEU16hTZl583S0LJu+mzfDkzXJKUNWGJ3k2ZoXOM1ughp71:21MlCC0Ybzf4zZKUok5oXN8i1

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1448	New Project Script - Linkvertise Downloader_I1-gKu1.tmp

Loads dropped DLL 3 IoCs

pid	Process
1448	New Project Script - Linkvertise Downloader_I1-gKu1.tmp
1448	New Project Script - Linkvertise Downloader_I1-gKu1.tmp
1448	New Project Script - Linkvertise Downloader_I1-gKu1.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 1448	400	New Project Script - Linkvertise Downloader_I1-gKu1.exe	86
PID 400 wrote to memory of 1448	400	New Project Script - Linkvertise Downloader_I1-gKu1.exe	86
PID 400 wrote to memory of 1448	400	New Project Script - Linkvertise Downloader_I1-gKu1.exe	86

C:\Users\Admin\AppData\Local\Temp\New Project Script - Linkvertise Downloader_I1-gKu1.exe
"C:\Users\Admin\AppData\Local\Temp\New Project Script - Linkvertise Downloader_I1-gKu1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Local\Temp\is-RTD04.tmp\New Project Script - Linkvertise Downloader_I1-gKu1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RTD04.tmp\New Project Script - Linkvertise Downloader_I1-gKu1.tmp" /SL5="$B006C,10376221,1235456,C:\Users\Admin\AppData\Local\Temp\New Project Script - Linkvertise Downloader_I1-gKu1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-MIKM1.tmp\AppUtils.dll

Filesize
1.8MB

MD5
43ce6d593abd5141a3139603f352ae05

SHA1
a97c75e23d275dddfde15ef5fdf3ff3253c0992c

SHA256
94e874f2702ea6be50e7d74864b66e7f763449c3db237803f3fad6adfd64ed3d

SHA512
bfc527529e5f73ba190dfc5bd043175c7e2ae963b665d6d39421c29e025020f1d593dc88b7bee33d86ef6b4f7a4c5e1a0339df4e99cab6849a275d1dda9f439f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MIKM1.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MIKM1.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RTD04.tmp\New Project Script - Linkvertise Downloader_I1-gKu1.tmp

Filesize
3.4MB

MD5
fbbad8149a1c6aed741101d3011757cb

SHA1
badef69a28b857fdd0b9859552736faba9e8886a

SHA256
d5f92ec4e4f095bea8fb56825333eaa6c3fb5e3b2dfc245bac058cdfb6cef4b8

SHA512
edc6d6cba79cc6d595cdc72f448189e9d5f5b0208c09bbfdd6344cd029848ec155e5aa744eac437a13f14f61b0297308b36df90b190a138e4c34aa8bb45d3b42

Download Submit
memory/400-133-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/400-151-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/400-165-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/1448-150-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/1448-152-0x0000000000400000-0x0000000000775000-memory.dmp

Filesize
3.5MB

Download
memory/1448-156-0x0000000003660000-0x000000000366F000-memory.dmp

Filesize
60KB

Download
memory/1448-163-0x0000000000400000-0x0000000000775000-memory.dmp

Filesize
3.5MB

Download