fcd3a1825386eb0b08d3c8a686acf5d05e534c10d866539984caa74ec968d931

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2023, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe
Size

1.7MB
MD5

d9e11790a7fef40f5776de7d38a65bbb
SHA1

c5c62a5807d8876ece11fd31495679fbe25eeb3d
SHA256

a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11
SHA512

d7dbc0e9f86e2035f18e713aeb29c906179f984bcc2a7bb3a398c3dbfc1801c1e51dea73263e27542a1bfa40f739ae338a700a85b3b619be61ca371941df8137
SSDEEP

24576:R7FUDowAyrTVE3U5Fmdvpi4PaJPfrT90eKc4cgFLNPfs8duMpmsDx:RBuZrEUqpi4wPH9RHgFLRdp/t

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1468	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp

Loads dropped DLL 2 IoCs

pid	Process
1468	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp
1468	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1468	1740	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe	87
PID 1740 wrote to memory of 1468	1740	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe	87
PID 1740 wrote to memory of 1468	1740	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe	87

C:\Users\Admin\AppData\Local\Temp\a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe
"C:\Users\Admin\AppData\Local\Temp\a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Local\Temp\is-BM0PS.tmp\a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BM0PS.tmp\a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp" /SL5="$8007E,875199,832512,C:\Users\Admin\AppData\Local\Temp\a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-BM0PS.tmp\a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp

Filesize
3.0MB

MD5
f992278fb92d50ca8bb4a6f43772b4cc

SHA1
e895323b721206603a903181c810e0f1139178f3

SHA256
1e4d2015f5e9dde2450695ff67ca0353ba26c404c021aadbd8faac65c04cdeb5

SHA512
db7ae9794d225da68f4c672426110e32abf3c12373f8b3988a148345e18d7917c2286568f14040ae385418ed38a3a2409c74ea977f32b65d1e7ac77943f0409e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-S4QPK.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-S4QPK.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
memory/1468-138-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/1468-143-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/1468-144-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/1468-148-0x00000000068E0000-0x00000000068EF000-memory.dmp

Filesize
60KB

Download
memory/1468-152-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/1740-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1740-142-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1740-154-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download