Analysis
-
max time kernel
1800s -
max time network
1227s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
-
submitted
02-07-2023 09:15
General
-
Target
taxi boss op gui - Linkvertise Downloader_M90-2E1.exe
-
Size
10.8MB
-
MD5
de8e7166adfa4f754f76cd9be3a8f9dc
-
SHA1
7da94302bd363f7647f9c4b16b7b095ab8996a9a
-
SHA256
faf1188718206d1764153f7184eb53e95c72a117fd8c7e957743557b4f208961
-
SHA512
34675d4546ec8798ab8d99132e1aae4948875027023f2c758d580b9964d26af32dde814ece415321e705b1e07fa96fe676477bc2e56b64540d997c83f74392aa
-
SSDEEP
196608:P38JJEU16hTZl583S0LJu+mzfDkzXJKUNWGJ3k2ZoXOM1ugh1:Q1MlCC0Ybzf4zZKUok5oXN86
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\taxi boss op gui - Linkvertise Downloader_M90-2E1.exe"C:\Users\Admin\AppData\Local\Temp\taxi boss op gui - Linkvertise Downloader_M90-2E1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SO3HD.tmp\taxi boss op gui - Linkvertise Downloader_M90-2E1.tmp"C:\Users\Admin\AppData\Local\Temp\is-SO3HD.tmp\taxi boss op gui - Linkvertise Downloader_M90-2E1.tmp" /SL5="$1E0022,10373288,1230848,C:\Users\Admin\AppData\Local\Temp\taxi boss op gui - Linkvertise Downloader_M90-2E1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD536b37e0b2ce4747ceac6f895ec3e1660
SHA11b961ff51b855a48626bf03326ac08c68744b3ca
SHA256d189b03c957346c8beee98d3f2b1956381eefb67e7818b476e93494e28acd681
SHA512ac8a2797769743106631a2aa8f36940ecad11c6c91ac8e86d1a846ffeb3005a3704ce1401290d9dca54b859a4c5ee261c8804f7b7e8d59a01047a3e1126d150f
-
Filesize
1.8MB
MD543ce6d593abd5141a3139603f352ae05
SHA1a97c75e23d275dddfde15ef5fdf3ff3253c0992c
SHA25694e874f2702ea6be50e7d74864b66e7f763449c3db237803f3fad6adfd64ed3d
SHA512bfc527529e5f73ba190dfc5bd043175c7e2ae963b665d6d39421c29e025020f1d593dc88b7bee33d86ef6b4f7a4c5e1a0339df4e99cab6849a275d1dda9f439f
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
29KB
MD506b0076d9f4e2488d32855a0161e9c74
SHA17dbc3c098f7fb1256aeca79c256b75802b5fdd69
SHA256929243f002eb4209a9e68af6744a3d63ece2b173c910a59d6752536dabf3870b
SHA5127cecc1fc1c13f97dfe1ae7592918c9df16233851a8dd667ac2199b92fd24410a6ef76acfa014cd00aad2d27dfe2887f41100563cf2240f720466dbebaed0375a
-
Filesize
4KB
-
Filesize
60KB
-
Filesize
3.4MB
-
Filesize
60KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
