785565ac4cf379c857f97890070e7f82afdf72f9e65e1a71902732af0fc00110

Analysis

max time kernel
152s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2023, 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

freemind.exe
Size

61.9MB
MD5

83cd813c584aba7272bf221da9014e19
SHA1

c952a9f91587fa661a9e66741a472d7bb70c192f
SHA256

785565ac4cf379c857f97890070e7f82afdf72f9e65e1a71902732af0fc00110
SHA512

3110d0ab355904a0d84982010687fb2d201611c19a6399edd90327cee09fda9eb322c280446fb750ca033c5ab9fc5ce1b589438fdb31774f4ef9c3d1507058ad
SSDEEP

1572864:4qeNFSP4gwKIqr6bWNv1NNdhh5j28K51BlNQHypmj3n:4/FUHyWd1NHhh128KxlgyY3n

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3332	freemind.tmp

Loads dropped DLL 3 IoCs

pid	Process
3332	freemind.tmp
3332	freemind.tmp
3332	freemind.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 3332	4828	freemind.exe	84
PID 4828 wrote to memory of 3332	4828	freemind.exe	84
PID 4828 wrote to memory of 3332	4828	freemind.exe	84

C:\Users\Admin\AppData\Local\Temp\freemind.exe
"C:\Users\Admin\AppData\Local\Temp\freemind.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Temp\is-A4VH2.tmp\freemind.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-A4VH2.tmp\freemind.tmp" /SL5="$70180,64625855,56832,C:\Users\Admin\AppData\Local\Temp\freemind.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-A4VH2.tmp\freemind.tmp

Filesize
690KB

MD5
a2c4d52c66b4b399facadb8cc8386745

SHA1
c326304c56a52a3e5bfbdce2fef54604a0c653e0

SHA256
6c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a

SHA512
2a66256ff8535e2b300aa0ca27b76e85d42422b0aaf5e7e6d055f7abb9e338929c979e185c6be8918d920fb134b7f28a76b714579cacb8ace09000c046dd34d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-A4VH2.tmp\freemind.tmp

Filesize
690KB

MD5
a2c4d52c66b4b399facadb8cc8386745

SHA1
c326304c56a52a3e5bfbdce2fef54604a0c653e0

SHA256
6c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a

SHA512
2a66256ff8535e2b300aa0ca27b76e85d42422b0aaf5e7e6d055f7abb9e338929c979e185c6be8918d920fb134b7f28a76b714579cacb8ace09000c046dd34d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JKSBG.tmp\FreeMind.gif

Filesize
5KB

MD5
d1901cbcb582ceac857c8745255faa6f

SHA1
f937b62d2fdd652dba75dda3efcfce780f87230e

SHA256
9718fa28ddd30f7c81065e9855495c4a3b3082135f4be2bc1de6547feec46a5c

SHA512
efb0066a8b02c2ed9b3127e3bf99eb696f696fc13e00545ff8ac47782353ed9f8a62c3e77d9061428ba6efd0b55ef8f7be59636d20d013289ff152f11cff4dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JKSBG.tmp\FreeMind1.gif

Filesize
5KB

MD5
5630578c8236148833c12a58c14530d4

SHA1
a6478f98bf73f7cc18f151c98cc18885321c9bc4

SHA256
138e1d09eb36704e82565317c9b7b616910368c1634733bb4899dfffe6efbffe

SHA512
8cea49d492f8d7ddaf8e9df40b75b03ab8397fd70aa51074c35e2f0a373ceb2b3f87110a10bf51fe08ab190e9ab8ee4b4049359682df8c6647b2999c0e62f5ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JKSBG.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JKSBG.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JKSBG.tmp\isxbb.dll

Filesize
11KB

MD5
3133066770f4cbabc512bb73ca6c39ff

SHA1
5ea2a744442c521c72c2c9de7513cd05b961e591

SHA256
8acfa833388f02a698896ca8c581d098c9ea71d5d38b3d40757e1693788f1565

SHA512
7bcf1d56301b4f40ac10ba74f80c1cb21b6e95ef382c1310e4b2086da709eb62a3eb870c05a44990d75015f4fcfda4873442e1e42d0083f9bda2f7939e612234

Download Submit
memory/3332-139-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/3332-165-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3332-166-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/4828-133-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4828-164-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads