Analysis
-
max time kernel
141s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-06-2023 07:44
Static task
static1
Behavioral task
behavioral1
Sample
UltraViewer_setup_6.5_en.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
UltraViewer_setup_6.5_en.exe
Resource
win10v2004-20230220-en
General
-
Target
UltraViewer_setup_6.5_en.exe
-
Size
3.3MB
-
MD5
4b9654f520013fabea815a15fbd1239f
-
SHA1
22a1bb4ca2ae3e10d55b1d8f1a5e971a8377aceb
-
SHA256
7db985064e0bf2f94ee071a83f57f8611e06039f0adcced38065deedf621526a
-
SHA512
9fde8059234cbec32cb5fd4343f817ae296f5eb168a4005ec20ba70fc2becee1104d4baf54024ac972fd9a1ff97807363adc42326633026ca3ec48807d848d20
-
SSDEEP
98304:q5zPcDIMzv+RZ6zZ5wvthoRViePTZ6lqLxjo:q5ozveZ6zZ5wvzeLZkqLxc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
UltraViewer_setup_6.5_en.tmppid process 2028 UltraViewer_setup_6.5_en.tmp -
Loads dropped DLL 3 IoCs
Processes:
UltraViewer_setup_6.5_en.exeUltraViewer_setup_6.5_en.tmppid process 1704 UltraViewer_setup_6.5_en.exe 2028 UltraViewer_setup_6.5_en.tmp 2028 UltraViewer_setup_6.5_en.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
UltraViewer_setup_6.5_en.tmppid process 2028 UltraViewer_setup_6.5_en.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
UltraViewer_setup_6.5_en.exedescription pid process target process PID 1704 wrote to memory of 2028 1704 UltraViewer_setup_6.5_en.exe UltraViewer_setup_6.5_en.tmp PID 1704 wrote to memory of 2028 1704 UltraViewer_setup_6.5_en.exe UltraViewer_setup_6.5_en.tmp PID 1704 wrote to memory of 2028 1704 UltraViewer_setup_6.5_en.exe UltraViewer_setup_6.5_en.tmp PID 1704 wrote to memory of 2028 1704 UltraViewer_setup_6.5_en.exe UltraViewer_setup_6.5_en.tmp PID 1704 wrote to memory of 2028 1704 UltraViewer_setup_6.5_en.exe UltraViewer_setup_6.5_en.tmp PID 1704 wrote to memory of 2028 1704 UltraViewer_setup_6.5_en.exe UltraViewer_setup_6.5_en.tmp PID 1704 wrote to memory of 2028 1704 UltraViewer_setup_6.5_en.exe UltraViewer_setup_6.5_en.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\UltraViewer_setup_6.5_en.exe"C:\Users\Admin\AppData\Local\Temp\UltraViewer_setup_6.5_en.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\is-0EACP.tmp\UltraViewer_setup_6.5_en.tmp"C:\Users\Admin\AppData\Local\Temp\is-0EACP.tmp\UltraViewer_setup_6.5_en.tmp" /SL5="$70124,3075958,121344,C:\Users\Admin\AppData\Local\Temp\UltraViewer_setup_6.5_en.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2028
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD590fc739c83cd19766acb562c66a7d0e2
SHA1451f385a53d5fed15e7649e7891e05f231ef549a
SHA256821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
SHA5124cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c
-
Filesize
1.1MB
MD590fc739c83cd19766acb562c66a7d0e2
SHA1451f385a53d5fed15e7649e7891e05f231ef549a
SHA256821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
SHA5124cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c
-
Filesize
232KB
MD555c310c0319260d798757557ab3bf636
SHA10892eb7ed31d8bb20a56c6835990749011a2d8de
SHA25654e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
SHA512e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4