75085e19a2fb105bf96bf5f942cd3fce8c4bd71e8d761c16e96d194e45a5d555

Resubmissions

02-08-2023 03:32

230802-d3s5msce36 8

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2023 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

utweb_installer.exe
Size

1.7MB
MD5

429e56e044f63422147b548ed1bd97a8
SHA1

c26d32fd4fd0628381ecac39c60cc1c4808b3fe0
SHA256

75085e19a2fb105bf96bf5f942cd3fce8c4bd71e8d761c16e96d194e45a5d555
SHA512

c3a67877ec16e85f8f55027ad05b7644517d725575432cb4ebe5ae5da5b95bc258d0cac2145b571ef1f2522bdd19507516a0edc747c08d62bcc9f2cb10a8a5cb
SSDEEP

24576:v7FUDowAyrTVE3U5FxXuX5LsU/gpJPl/M/EdYgLMp/rcisGTjgy8xJ4aldp78JH:vBuZrEUleRjIpZlU/EigLerrzTjg5M9H

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{0EDABC5B-D3E8-438D-A67B-8542FAC8D782}.catalogItem	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

utweb_installer.tmp

pid process

3056 utweb_installer.tmp
Loads dropped DLL 2 IoCs

Processes:

utweb_installer.tmp

pid process

3056 utweb_installer.tmp
3056 utweb_installer.tmp
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 15 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
3056	utweb_installer.tmp

pid	process
3056	utweb_installer.tmp
3056	utweb_installer.tmp

description	flow	ioc
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

utweb_installer.exe

description	pid	process	target process
PID 4472 wrote to memory of 3056	4472	utweb_installer.exe	utweb_installer.tmp
PID 4472 wrote to memory of 3056	4472	utweb_installer.exe	utweb_installer.tmp
PID 4472 wrote to memory of 3056	4472	utweb_installer.exe	utweb_installer.tmp

C:\Users\Admin\AppData\Local\Temp\utweb_installer.exe
"C:\Users\Admin\AppData\Local\Temp\utweb_installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4472

C:\Users\Admin\AppData\Local\Temp\is-5OEI5.tmp\utweb_installer.tmp
"C:\Users\Admin\AppData\Local\Temp\is-5OEI5.tmp\utweb_installer.tmp" /SL5="$70170,898126,819200,C:\Users\Admin\AppData\Local\Temp\utweb_installer.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:2984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-5OEI5.tmp\utweb_installer.tmp

Filesize
3.0MB

MD5
c9f691236ee6a47257a5ffa64ff13831

SHA1
3fd1df0f872431f2028d7727c55441e9cfb6ed0c

SHA256
0c08e3fb5c375a4935d3bc08574a0d810630131f1af44a3541555038984566b6

SHA512
ddd660c2bd3afa0c3e7b2334d132bd489df6a07bd5ba0a13b439b29667abb51432f863790b299e1d463e968a6611e6f6b72ce2c540ebfd185ac6c023006397a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O6STJ.tmp\Logo.png

Filesize
12KB

MD5
a00cfe887e254c462ad0c6a6d3fb25b6

SHA1
c603a192e23df46c719febf07fd4207c96b1f0f9

SHA256
bca0271f56f7384942ff3affb79fa78ccdceabf7dda89ad3c138226da324cdb1

SHA512
6dc95a05e2712d85067aa92144f7e00871d2f60e377c6df0253e3ff48a02280d4148578fbbf22018693227bdcc035a8bd391f3c390aed39ca58749f28fc19862

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O6STJ.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O6STJ.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
memory/3056-139-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/3056-149-0x0000000003990000-0x000000000399F000-memory.dmp

Filesize
60KB

Download
memory/3056-163-0x0000000000400000-0x0000000000710000-memory.dmp

Filesize
3.1MB

Download
memory/3056-164-0x0000000003990000-0x000000000399F000-memory.dmp

Filesize
60KB

Download
memory/3056-165-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/4472-134-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/4472-161-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download