dd479820f34498c706bd61c4e7bdafc18a739e397762d7e16d7ad0b9a4cbd79f

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/04/2023, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vc_redist.x64.exe
Size

14.3MB
MD5

528538419a5a6f889650b2721813f228
SHA1

ff15c4f5da3c54f88676e6b44f3314b173835c28
SHA256

dd479820f34498c706bd61c4e7bdafc18a739e397762d7e16d7ad0b9a4cbd79f
SHA512

dd4e07ace83b15fd82abc5f5860bfdab93f06069ee3a6d8406225401aba43dd964c741fbe08979ea1c064109c94686e30c0406dc0da05e44b355361efe449785
SSDEEP

393216:TWlp+dkBSuF2SfUfn6vNj8ODo3jFNvg32Y9kann/p:qp+Ty2SfUfnAxwNvg32Y9L

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1356	vc_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1356	1264	vc_redist.x64.exe	28
PID 1264 wrote to memory of 1356	1264	vc_redist.x64.exe	28
PID 1264 wrote to memory of 1356	1264	vc_redist.x64.exe	28
PID 1264 wrote to memory of 1356	1264	vc_redist.x64.exe	28
PID 1264 wrote to memory of 1356	1264	vc_redist.x64.exe	28
PID 1264 wrote to memory of 1356	1264	vc_redist.x64.exe	28
PID 1264 wrote to memory of 1356	1264	vc_redist.x64.exe	28

C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe
"C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe
  "C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" -burn.unelevated BurnPipe.{83D5DF9D-74E6-4534-89E5-CF580262AF55} {2E7785B8-E02C-487D-B896-46D6B0D8F089} 1264
  2⤵
  - Loads dropped DLL
  PID:1356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{2cbcedbb-f38c-48a3-a3e1-6c6fd821a7f4}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
\Users\Admin\AppData\Local\Temp\{2cbcedbb-f38c-48a3-a3e1-6c6fd821a7f4}\.ba1\wixstdba.dll

Filesize
118KB

MD5
4d20a950a3571d11236482754b4a8e76

SHA1
e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c

SHA256
a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b

SHA512
8b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2

Download Submit