Overview

overview

8

Static

static

3

_________(...26.exe

windows7-x64

8

_________(...26.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    601s
  • max time network
    503s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2023, 06:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    _________(__UKey_)_20230426.exe

  • Size

    117.0MB

  • MD5

    aab9482ca26b0c73b0cb7eac1c7f5f96

  • SHA1

    a96260369c8f4152a868c483bfe631167ab3102f

  • SHA256

    f67a9d4064640ba5c4de32772089ed56f56e272ea4dc364afa04333637707c25

  • SHA512

    13f05c1f752dbdebe105c2081e25ad7b77db548418831a4500a72b6bbefda0034e1a0df31941a992a867ef8c57aff76c4ed0296e3db81c9650ffef04935fb441

  • SSDEEP

    3145728:EsFawBDEXd3Pz3UtVv9hv+cOO5rouK39E/1vkrBCduG2OSr6a:EEOZz3KB9hvNf5MugkB0BCd/a

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\_________(__UKey_)_20230426.exe
    "C:\Users\Admin\AppData\Local\Temp\_________(__UKey_)_20230426.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Users\Admin\AppData\Local\Temp\is-AR4B0.tmp\_________(__UKey_)_20230426.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-AR4B0.tmp\_________(__UKey_)_20230426.tmp" /SL5="$9002E,122343240,58880,C:\Users\Admin\AppData\Local\Temp\_________(__UKey_)_20230426.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-AR4B0.tmp\_________(__UKey_)_20230426.tmp
    Filesize

    915KB

    MD5

    4c913e52744572da0f7e4666e0135217

    SHA1

    66a93a75ca80ba90be7da26195ee2ec8225f0e92

    SHA256

    3535c90aea2ba57ac4cd29639757196c38865cd437e2eb2185a40cbd1a998ae6

    SHA512

    b0956a46003867b9e35b955cc970ef9976f9d9c2ff9679dd381542d2b1c676536c27644c3bc77e21b2b8bbbae9728fa4316a3233dbc82dfdcea4dab587b66662

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-AR4B0.tmp\_________(__UKey_)_20230426.tmp
    Filesize

    915KB

    MD5

    4c913e52744572da0f7e4666e0135217

    SHA1

    66a93a75ca80ba90be7da26195ee2ec8225f0e92

    SHA256

    3535c90aea2ba57ac4cd29639757196c38865cd437e2eb2185a40cbd1a998ae6

    SHA512

    b0956a46003867b9e35b955cc970ef9976f9d9c2ff9679dd381542d2b1c676536c27644c3bc77e21b2b8bbbae9728fa4316a3233dbc82dfdcea4dab587b66662

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\ISTask.dll
    Filesize

    66KB

    MD5

    86a1311d51c00b278cb7f27796ea442e

    SHA1

    ac08ac9d08f8f5380e2a9a65f4117862aa861a19

    SHA256

    e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

    SHA512

    129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\ISTask.dll
    Filesize

    66KB

    MD5

    86a1311d51c00b278cb7f27796ea442e

    SHA1

    ac08ac9d08f8f5380e2a9a65f4117862aa861a19

    SHA256

    e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

    SHA512

    129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\ISTask.dll
    Filesize

    66KB

    MD5

    86a1311d51c00b278cb7f27796ea442e

    SHA1

    ac08ac9d08f8f5380e2a9a65f4117862aa861a19

    SHA256

    e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

    SHA512

    129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\back.png
    Filesize

    71KB

    MD5

    7dad2f07871842a9a253f201a97fd5bd

    SHA1

    0de5a68d151aebecb75296705cca770d618c9d52

    SHA256

    de19e1b8fef8fbcf450eff0954386ff29a0befa0ef557c79ffd34ca994e23c9c

    SHA512

    d47d025a16d9358c48157aa6898980b66dfcff22f63531b76e1c72d9cdd871f9341d359e2e393e3dbf0886d5e0a4e9b035604c239fd3d0307ec796396ae2be93

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\botva2.dll
    Filesize

    35KB

    MD5

    0177746573eed407f8dca8a9e441aa49

    SHA1

    6b462adf78059d26cbc56b3311e3b97fcb8d05f7

    SHA256

    a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

    SHA512

    d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\botva2.dll
    Filesize

    35KB

    MD5

    0177746573eed407f8dca8a9e441aa49

    SHA1

    6b462adf78059d26cbc56b3311e3b97fcb8d05f7

    SHA256

    a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

    SHA512

    d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\botva2.dll
    Filesize

    35KB

    MD5

    0177746573eed407f8dca8a9e441aa49

    SHA1

    6b462adf78059d26cbc56b3311e3b97fcb8d05f7

    SHA256

    a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

    SHA512

    d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\btn_Browser.png
    Filesize

    70KB

    MD5

    721bd8a7177c9a18b862edeebf6ed0bf

    SHA1

    758b4547e96377d02e14b0ee44f396881bd5860b

    SHA256

    2e103cf01920a94e0cc4b3c72b1fab0c3c5279a02fbb1eb99762d275153bff9d

    SHA512

    8058dfa75ed3afcfd9b00724b6a32b40b8009c213f66f913f935f7ea2517e7411a2c8ed6934fc14b28af28bd14c7238e2bc17b74c0a95d0de6b30d3d5d71378b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\btn_close.png
    Filesize

    64KB

    MD5

    0dd8b13ac1b99b1d3851ebb80ea67863

    SHA1

    247b053cca9659d4e5f2fb3a66ed5407321266e9

    SHA256

    f5062585b775f5db4a501a6080a7d5b43cc9e78ea2600b2a4b825889f4a55743

    SHA512

    d418389edf9df122d76e4745b2cabf1ee1d0d55e1fb01ff9fc38a6067e195c7589444bb39962c05eca7953ce088e6364e95425550f08e59b3ecdff86d2ddd4f0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\btn_min.png
    Filesize

    63KB

    MD5

    d083599819db6e20de87bbeedd8a6faa

    SHA1

    9950982062ca382464e418b23890533b1c7ee2c0

    SHA256

    1a16cafbb38d0cd85197d8119707d9e5bfbdcb5bb7fab0ff9a8031656208dab2

    SHA512

    82a43178af909db0f1195fbdafe4296555001edb7a521b357e3a413fc75ea7c99a165f4cdaf28eb95b98cf1e5494b95f38febcd1091019b5581af049e8a3e6b0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\btn_n.png
    Filesize

    69KB

    MD5

    36dbc52114b3808cfe28cb81cab3b2f4

    SHA1

    7fb93f205fa53018498ee9841d00ab073c223a8a

    SHA256

    e13c91118d08a981233feb66b21d34ed403485f142ac621927561c6ae8a92374

    SHA512

    4f47bde79ad57c10e796ff88b22f28f269d9def650b2aa90f908ea877aba8fb233a9702fc80050cf231add90d527aa16179d7a9f8a06fb6b1ef79bb186cb706b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\btn_setup.png
    Filesize

    81KB

    MD5

    4564e698b1ab6d7199424ea03926a503

    SHA1

    12da72a5157d1d334742b0ca0d89823c5b8d876e

    SHA256

    4b549a6fe47cca4ff76246a031c2e8ad7a9b56e27b0e4e52c9e29a083d5c5b07

    SHA512

    79a50fe61bd23f07ebce360e7424446cf3f9a7c267427f50650930128311a1ee1c3b4fe606b373ac65697f7b757162b3dccec15a32f2dd7521945997f4e964af

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\checkboxdeep.png
    Filesize

    64KB

    MD5

    71c99fc4f8c870d3499bb50b17fe2218

    SHA1

    d7e1d3c3dcc61e33e32fc5ba4aaa4769634881be

    SHA256

    bc9a94d3220e7a635604e67b7075f85ccc06af707b6db9c475dc9e4bc29842f6

    SHA512

    15e6058e84323219f83557308f576b1e538ba5571aa5042ddb9b17720fe8b59fd7cd67a7fd67b0a1d25f7cffdb34862ecda6bb6df3df10d3201924230497ae6f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\innocallback.dll
    Filesize

    63KB

    MD5

    1c55ae5ef9980e3b1028447da6105c75

    SHA1

    f85218e10e6aa23b2f5a3ed512895b437e41b45c

    SHA256

    6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

    SHA512

    1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\innocallback.dll
    Filesize

    63KB

    MD5

    1c55ae5ef9980e3b1028447da6105c75

    SHA1

    f85218e10e6aa23b2f5a3ed512895b437e41b45c

    SHA256

    6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

    SHA512

    1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\innocallback.dll
    Filesize

    63KB

    MD5

    1c55ae5ef9980e3b1028447da6105c75

    SHA1

    f85218e10e6aa23b2f5a3ed512895b437e41b45c

    SHA256

    6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

    SHA512

    1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\license.png
    Filesize

    25KB

    MD5

    25caa4458650644437bcea55e98f253c

    SHA1

    8c05ec6fb167e240123f62157d1fd1f17a055aaa

    SHA256

    e71c5545e97bc8bf9d88db6cda564af3a838a7accfc51ed3e94ed78fa5a2b836

    SHA512

    27f7d63e0889cf0420a9f0eca4e2dd602b07be63e1a711ba895a0686158deedf4b05587ff617674c536a02d80a4930776262ad49cea935712f548566ffd01701

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-HND4Q.tmp\xy.png
    Filesize

    103KB

    MD5

    843f6eae32da636d9574ac068ab630f3

    SHA1

    690f43a4d2e21ab47cb50fe664bbf72438d7e528

    SHA256

    2ee78dbb3b96d6fe241ca0623a838368011f965896d02f08f31be67f89bbe0dc

    SHA512

    f77e5f7eb39447de2b52666e7fbfd3159824aeedc202edc04f301bd6c7a755713ec7948d359cc67cf6832ce029d6e9b4df4c191e005bbabdd13e54953c27c7a4

    Download Submit

  • memory/1436-261-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

    Download

  • memory/1436-262-0x0000000007260000-0x0000000007275000-memory.dmp

    Filesize

    84KB

    Download

  • memory/1436-168-0x00000000022C0000-0x00000000022C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1436-149-0x0000000007260000-0x0000000007275000-memory.dmp

    Filesize

    84KB

    Download

  • memory/1436-165-0x0000000007390000-0x00000000073A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/1436-280-0x0000000007390000-0x00000000073A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/1436-157-0x0000000007380000-0x000000000738E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1436-279-0x0000000007380000-0x000000000738E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1436-264-0x0000000007390000-0x00000000073A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/1436-263-0x0000000007380000-0x000000000738E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1436-265-0x00000000022C0000-0x00000000022C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1436-278-0x0000000007260000-0x0000000007275000-memory.dmp

    Filesize

    84KB

    Download

  • memory/2252-133-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

    Download

  • memory/2252-260-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

    Download