5c0678340a6c7c40dc5032b8ba79d2f28ca219b131d66220277d8831cf71a172

Analysis

max time kernel
84s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2023 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Internet Download Manager.exe
Size

51.4MB
MD5

64ad0955a658e33b3608646fffb380ec
SHA1

fd26aa8833e27e4e6da316bdb6758c1680dd563a
SHA256

5c0678340a6c7c40dc5032b8ba79d2f28ca219b131d66220277d8831cf71a172
SHA512

262fe5e07aa45178cac86ff4197f519279a7cab0d13ede5947a643433fbf824d12448f880eb8d0b6e936a6d3182baaa7c96b8674a3b99175630fbd2f8ffece75
SSDEEP

393216:Hht+6Mr1cZD2IgbzWFVyU2lvzsALwm37v5naf/1CPwDv3uFQQgs20:HSlr1cZD2fmS3v20

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3244	Internet Download Manager.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4532 set thread context of 3244	4532	Internet Download Manager.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3820	3244	WerFault.exe	84

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4532	Internet Download Manager.exe
4532	Internet Download Manager.exe
4532	Internet Download Manager.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84
PID 4532 wrote to memory of 3244	4532	Internet Download Manager.exe	84

C:\Users\Admin\AppData\Local\Temp\Internet Download Manager.exe
"C:\Users\Admin\AppData\Local\Temp\Internet Download Manager.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\Internet Download Manager.exe
  "C:\Program Files (x86)\Internet Download Manager\IDMan.exe"
  2⤵
  - Loads dropped DLL
  PID:3244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 552
    3⤵
    - Program crash
    PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3244 -ip 3244
1⤵
PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Internet Download Manager\DummyTLS\dummyTLS.dll

Filesize
87KB

MD5
05dc5ae141e2eaff6cdb954e7b1b6a8a

SHA1
7147d8872cac98cb8ae8b07c3d17f1c7bbe65f2e

SHA256
1c2fb97273304c3b9c9a72569b1f9ec0ee8323db118e5330736f9c33f8371dc1

SHA512
85c412747a0c25078c62490f2255fb758f18b0e114af59c438473da837cc879863906db03e1fdd874f72d03bddda6afdc338f1432b5276aa8f1897aab35e55e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Internet Download Manager\DummyTLS\dummyTLS.dll

Filesize
87KB

MD5
05dc5ae141e2eaff6cdb954e7b1b6a8a

SHA1
7147d8872cac98cb8ae8b07c3d17f1c7bbe65f2e

SHA256
1c2fb97273304c3b9c9a72569b1f9ec0ee8323db118e5330736f9c33f8371dc1

SHA512
85c412747a0c25078c62490f2255fb758f18b0e114af59c438473da837cc879863906db03e1fdd874f72d03bddda6afdc338f1432b5276aa8f1897aab35e55e6

Download Submit
memory/4532-133-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-139-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-140-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-141-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-142-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-143-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-144-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-145-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-146-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-147-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-148-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-149-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-150-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-151-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-152-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-153-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-154-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-155-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-157-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-156-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-158-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-159-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-160-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-161-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-162-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-163-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-165-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-166-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-164-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-167-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-168-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-169-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-170-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-171-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-173-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-172-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-174-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-175-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-177-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-176-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-178-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-179-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-180-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-181-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-182-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-184-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-183-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-186-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-185-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-187-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-188-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-189-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-190-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-191-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-192-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-193-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-194-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-195-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-196-0x000000007FC80000-0x000000007FE47000-memory.dmp

Filesize
1.8MB

Download
memory/4532-261-0x000000007FC60000-0x000000007FC70000-memory.dmp

Filesize
64KB

Download