Overview

overview

7

Static

static

3

IT_Installer.exe

windows7-x64

7

IT_Installer.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    27s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2023, 02:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    IT_Installer.exe

  • Size

    34.6MB

  • MD5

    9c3bc8e1696bd33066b46c66f3c8b187

  • SHA1

    f75c0333d616ec1796513297fc5fde137cc89695

  • SHA256

    ef82d6bee1621e8228be0d63b72cb129f72cf2857adca5fe8f95812666ab9671

  • SHA512

    d3a76629db6a470cc0daa8c9389b75dc1c063514eafae9bd296d021c20550df83d47970dd5ea951ff8901c3320658fa6b2023565d127c79b6fd0a7cbeeede296

  • SSDEEP

    786432:1faUkAMGHf/yVmKWAPd2/ft08gOw6JQpfK9G36huSOd9CW82BibjUS/zrp:1fNkAMe/yVMAl2/VRgb6JOK9G36huUWs

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\IT_Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\IT_Installer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\Users\Admin\AppData\Local\Temp\IT_Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\IT_Installer.exe"
      2⤵
      • Loads dropped DLL
      PID:732

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\_MEI9042\api-ms-win-core-file-l1-2-0.dll
          Filesize

          20KB

          MD5

          d92e6a007fc22a1e218552ebfb65da93

          SHA1

          3c9909332e94f7b7386664a90f52730f4027a75a

          SHA256

          03bd3217eae0ef68521b39556e7491292db540f615da873dd8da538693b81862

          SHA512

          b8b0e6052e68c08e558e72c168e4ff318b1907c4dc5fc1cd1104f5cae7cc418293013dabbb30c835a5c35a456e1cb22cc352b7ae40f82b9b7311bb7419d854c7

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI9042\api-ms-win-core-file-l2-1-0.dll
          Filesize

          20KB

          MD5

          50abf0a7ee67f00f247bada185a7661c

          SHA1

          0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

          SHA256

          f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

          SHA512

          c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI9042\api-ms-win-core-localization-l1-2-0.dll
          Filesize

          20KB

          MD5

          de5695f26a0bcb54f59a8bc3f9a4ecef

          SHA1

          99c32595f3edc2c58bdb138c3384194831e901d6

          SHA256

          e9539fce90ad8be582b25ab2d5645772c2a5fb195e602ecdbf12b980656e436a

          SHA512

          df635d5d51cdea24885ae9f0406f317ddcf04ecb6bfa26579bb2e256c457057607844ded4b52ff1f5ca25abe29d1eb2b20f1709cf19035d3829f36bbe31f550f

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI9042\api-ms-win-core-processthreads-l1-1-1.dll
          Filesize

          20KB

          MD5

          74c264cffc09d183fcb1555b16ea7e4b

          SHA1

          0b5b08cdf6e749b48254ac811ca09ba95473d47c

          SHA256

          a8e2fc077d9a7d2faa85e1e6833047c90b22c6086487b98fc0e6a86b7bf8bf09

          SHA512

          285afbcc39717510ced2ed096d9f77fc438268ecaa59cff3cf167fcc538e90c73c67652046b0ee379e0507d6e346af79d43c51a571c6dd66034f9385a73d00d1

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI9042\api-ms-win-core-timezone-l1-1-0.dll
          Filesize

          20KB

          MD5

          cb39eea2ef9ed3674c597d5f0667b5b4

          SHA1

          c133dc6416b3346fa5b0f449d7cc6f7dbf580432

          SHA256

          1627b921934053f1f7d2a19948aee06fac5db8ee8d4182e6f071718d0681f235

          SHA512

          2c65014dc045a2c1e5f52f3fea4967d2169e4a78d41fe56617ce9a4d5b30ebf25043112917ff3d7d152744ddef70475937ae0a7f96785f97dcefafe8e6f14d9c

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI9042\jsonschema-4.17.3.dist-info\INSTALLER
          Filesize

          4B

          MD5

          365c9bfeb7d89244f2ce01c1de44cb85

          SHA1

          d7a03141d5d6b1e88b6b59ef08b6681df212c599

          SHA256

          ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

          SHA512

          d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI9042\python310.dll
          Filesize

          4.3MB

          MD5

          c80b5cb43e5fe7948c3562c1fff1254e

          SHA1

          f73cb1fb9445c96ecd56b984a1822e502e71ab9d

          SHA256

          058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

          SHA512

          faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI9042\ucrtbase.dll
          Filesize

          1.1MB

          MD5

          3b337c2d41069b0a1e43e30f891c3813

          SHA1

          ebee2827b5cb153cbbb51c9718da1549fa80fc5c

          SHA256

          c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

          SHA512

          fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI9042\api-ms-win-core-file-l1-2-0.dll
          Filesize

          20KB

          MD5

          d92e6a007fc22a1e218552ebfb65da93

          SHA1

          3c9909332e94f7b7386664a90f52730f4027a75a

          SHA256

          03bd3217eae0ef68521b39556e7491292db540f615da873dd8da538693b81862

          SHA512

          b8b0e6052e68c08e558e72c168e4ff318b1907c4dc5fc1cd1104f5cae7cc418293013dabbb30c835a5c35a456e1cb22cc352b7ae40f82b9b7311bb7419d854c7

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI9042\api-ms-win-core-file-l2-1-0.dll
          Filesize

          20KB

          MD5

          50abf0a7ee67f00f247bada185a7661c

          SHA1

          0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

          SHA256

          f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

          SHA512

          c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI9042\api-ms-win-core-localization-l1-2-0.dll
          Filesize

          20KB

          MD5

          de5695f26a0bcb54f59a8bc3f9a4ecef

          SHA1

          99c32595f3edc2c58bdb138c3384194831e901d6

          SHA256

          e9539fce90ad8be582b25ab2d5645772c2a5fb195e602ecdbf12b980656e436a

          SHA512

          df635d5d51cdea24885ae9f0406f317ddcf04ecb6bfa26579bb2e256c457057607844ded4b52ff1f5ca25abe29d1eb2b20f1709cf19035d3829f36bbe31f550f

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI9042\api-ms-win-core-processthreads-l1-1-1.dll
          Filesize

          20KB

          MD5

          74c264cffc09d183fcb1555b16ea7e4b

          SHA1

          0b5b08cdf6e749b48254ac811ca09ba95473d47c

          SHA256

          a8e2fc077d9a7d2faa85e1e6833047c90b22c6086487b98fc0e6a86b7bf8bf09

          SHA512

          285afbcc39717510ced2ed096d9f77fc438268ecaa59cff3cf167fcc538e90c73c67652046b0ee379e0507d6e346af79d43c51a571c6dd66034f9385a73d00d1

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI9042\api-ms-win-core-timezone-l1-1-0.dll
          Filesize

          20KB

          MD5

          cb39eea2ef9ed3674c597d5f0667b5b4

          SHA1

          c133dc6416b3346fa5b0f449d7cc6f7dbf580432

          SHA256

          1627b921934053f1f7d2a19948aee06fac5db8ee8d4182e6f071718d0681f235

          SHA512

          2c65014dc045a2c1e5f52f3fea4967d2169e4a78d41fe56617ce9a4d5b30ebf25043112917ff3d7d152744ddef70475937ae0a7f96785f97dcefafe8e6f14d9c

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI9042\python310.dll
          Filesize

          4.3MB

          MD5

          c80b5cb43e5fe7948c3562c1fff1254e

          SHA1

          f73cb1fb9445c96ecd56b984a1822e502e71ab9d

          SHA256

          058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

          SHA512

          faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI9042\ucrtbase.dll
          Filesize

          1.1MB

          MD5

          3b337c2d41069b0a1e43e30f891c3813

          SHA1

          ebee2827b5cb153cbbb51c9718da1549fa80fc5c

          SHA256

          c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

          SHA512

          fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

          Download Submit