d4581c971ca9da0b40b609ed356a986b33e4e81289edacd31dc7ab8348a14d20

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2554efc048201c086d7be46f42d00bd.exe
Size

8.3MB
MD5

b2554efc048201c086d7be46f42d00bd
SHA1

f6a8986f77c54cce7544d4779a77d878a39ad402
SHA256

d4581c971ca9da0b40b609ed356a986b33e4e81289edacd31dc7ab8348a14d20
SHA512

6e8ed36e85ee9fbbde577ec0b2a5da6ff71872b6580e2caeffdd34820a502b4a8d8e417087a46fe21ac76bb4a9313f4e4068b06696f8ea4285485ef3f41a01da
SSDEEP

196608:AxlS+oStveNjFvtv4jQ0Y4ZLNHDj53lPu6pdWFG:A6+v5cjFvtw00dZLJBNu6Pp

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4284	b2554efc048201c086d7be46f42d00bd.tmp

Loads dropped DLL 2 IoCs

pid	Process
4284	b2554efc048201c086d7be46f42d00bd.tmp
4284	b2554efc048201c086d7be46f42d00bd.tmp

Kills process with taskkill 2 IoCs

evasion

pid	Process
1828	taskkill.exe
2660	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	2660	taskkill.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 4284	2024	b2554efc048201c086d7be46f42d00bd.exe	86
PID 2024 wrote to memory of 4284	2024	b2554efc048201c086d7be46f42d00bd.exe	86
PID 2024 wrote to memory of 4284	2024	b2554efc048201c086d7be46f42d00bd.exe	86
PID 4284 wrote to memory of 1828	4284	b2554efc048201c086d7be46f42d00bd.tmp	95
PID 4284 wrote to memory of 1828	4284	b2554efc048201c086d7be46f42d00bd.tmp	95
PID 4284 wrote to memory of 2660	4284	b2554efc048201c086d7be46f42d00bd.tmp	98
PID 4284 wrote to memory of 2660	4284	b2554efc048201c086d7be46f42d00bd.tmp	98

C:\Users\Admin\AppData\Local\Temp\b2554efc048201c086d7be46f42d00bd.exe
"C:\Users\Admin\AppData\Local\Temp\b2554efc048201c086d7be46f42d00bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\is-U59BK.tmp\b2554efc048201c086d7be46f42d00bd.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-U59BK.tmp\b2554efc048201c086d7be46f42d00bd.tmp" /SL5="$50214,7803864,941056,C:\Users\Admin\AppData\Local\Temp\b2554efc048201c086d7be46f42d00bd.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill.exe" /f /im "RocketLeague.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1828
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill.exe" /f /im "BakkesMod.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-S5HSR.tmp\_isetup\_isdecmp.dll

Filesize
34KB

MD5
c6ae924ad02500284f7e4efa11fa7cfc

SHA1
2a7770b473b0a7dc9a331d017297ff5af400fed8

SHA256
31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26

SHA512
f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-S5HSR.tmp\_isetup\_isdecmp.dll

Filesize
34KB

MD5
c6ae924ad02500284f7e4efa11fa7cfc

SHA1
2a7770b473b0a7dc9a331d017297ff5af400fed8

SHA256
31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26

SHA512
f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U59BK.tmp\b2554efc048201c086d7be46f42d00bd.tmp

Filesize
3.1MB

MD5
8f4a51f9a89e8e04fc8a465436b5bba9

SHA1
97e3a485e2248da74afa556d550c1fe0c3e9629d

SHA256
6c0c57a9dea98d5a31dbf99d880dd828d094965397fe453f20fe186c55b33265

SHA512
16fd012759c93c641aaf9e4384f6b1a90df4c1678bc2f4555bc46aabef67beaf1f2fb72fbf9b2b8149fcd007fb2115dcb03e59837833ec74354a2a2f1e63dbc4

Download Submit
memory/2024-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2024-146-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4284-139-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/4284-147-0x0000000000400000-0x000000000072D000-memory.dmp

Filesize
3.2MB

Download
memory/4284-148-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download