Analysis

  • max time kernel
    152s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/08/2023, 17:39

General

  • Target

    tmp.exe

  • Size

    65.1MB

  • MD5

    0032cf9b48ee2a82c039e273c410ec28

  • SHA1

    30bf8f8c55e165c5dd618a303b7a7db4527df54a

  • SHA256

    350773db484892bc85b1d453d10a1e9c8f2405ab2de643561a952366fca1d48c

  • SHA512

    565ac5e5867838a92930cc8ddf5e02e262343539f07076cb912a120df12180e59ea403d745ca7d35fa7fe4b4d22bcb2d7dc83a10d7ab3926125d8e6d3fb906bf

  • SSDEEP

    1572864:glApvY5jlYCEFhq6Vy5gjFPDST/Ds5tG87FcEYkudPK/zVZ66p:9vY5KZqqy5gRWHQd9cPEzV1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Users\Admin\AppData\Local\Temp\is-H9NAM.tmp\tmp.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-H9NAM.tmp\tmp.tmp" /SL5="$60062,67977372,68608,C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-7C88A.tmp\Office2007.cjstyles

    Filesize

    624KB

    MD5

    32a4c49ff3b8b4b8a8831e6d70ccbeaa

    SHA1

    dda5601b8e100a5091e6898bb3d23e1b68833c51

    SHA256

    157f7e47a9f7ed38ce35bef17606ff1026fe49ef8a71fb840c088d92fe6d36bd

    SHA512

    d8113e949c3f9e15904215f4bda825e7d2d11a4e96279c9e6421c96ebb8c05bf16e2114d735bd4fd2dce8f1a75fe6f6cdda3116bbdcaf6d821f0336849a5ca64

  • C:\Users\Admin\AppData\Local\Temp\is-7C88A.tmp\Office2007.cjstyles

    Filesize

    624KB

    MD5

    32a4c49ff3b8b4b8a8831e6d70ccbeaa

    SHA1

    dda5601b8e100a5091e6898bb3d23e1b68833c51

    SHA256

    157f7e47a9f7ed38ce35bef17606ff1026fe49ef8a71fb840c088d92fe6d36bd

    SHA512

    d8113e949c3f9e15904215f4bda825e7d2d11a4e96279c9e6421c96ebb8c05bf16e2114d735bd4fd2dce8f1a75fe6f6cdda3116bbdcaf6d821f0336849a5ca64

  • C:\Users\Admin\AppData\Local\Temp\is-7C88A.tmp\isskin.dll

    Filesize

    385KB

    MD5

    92c2e247392e0e02261dea67e1bb1a5e

    SHA1

    db72fed8771364bf8039b2bc83ed01dda2908554

    SHA256

    25fdb94e386f8a41f10aba00ed092a91b878339f8e256a7252b11169122b0a68

    SHA512

    e938d2a1870ccb437d818b5301e6ecffaa6efbf4f0122e1a1ae0981057d7d0376039ea927c6fd326456da2d6904803fca26b87245367a4c5de2aebc47bdcd4b5

  • C:\Users\Admin\AppData\Local\Temp\is-7C88A.tmp\itdownload.dll

    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

  • C:\Users\Admin\AppData\Local\Temp\is-7C88A.tmp\itdownload.dll

    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

  • C:\Users\Admin\AppData\Local\Temp\is-H9NAM.tmp\tmp.tmp

    Filesize

    703KB

    MD5

    f5372e78e27904257b5bfcf445bfab16

    SHA1

    9d85663b029796db96163ac454fba73ccdb86989

    SHA256

    9f949b582d84d0d8d735cc32d6a91bb9a07ab0f23dbd02dedb2b7631f1787996

    SHA512

    b69ac8afd4134649bc8334ea0064af03b9bdb8cd6ad3a6c44dff7b15c8610b45398eaf8a84ca13a3745aeecd3ae3c3147210458fce36989cecf0bc67fadc2941

  • memory/2412-1-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2412-160-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2580-52-0x0000000075A50000-0x0000000075C60000-memory.dmp

    Filesize

    2.1MB

  • memory/2580-57-0x0000000076470000-0x000000007651F000-memory.dmp

    Filesize

    700KB

  • memory/2580-26-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-27-0x00000000773A0000-0x000000007741A000-memory.dmp

    Filesize

    488KB

  • memory/2580-28-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-29-0x00000000773A0000-0x000000007741A000-memory.dmp

    Filesize

    488KB

  • memory/2580-30-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-31-0x00000000773A0000-0x000000007741A000-memory.dmp

    Filesize

    488KB

  • memory/2580-32-0x0000000077040000-0x0000000077065000-memory.dmp

    Filesize

    148KB

  • memory/2580-33-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-34-0x00000000773A0000-0x000000007741A000-memory.dmp

    Filesize

    488KB

  • memory/2580-35-0x0000000077040000-0x0000000077065000-memory.dmp

    Filesize

    148KB

  • memory/2580-36-0x0000000074D60000-0x0000000074D90000-memory.dmp

    Filesize

    192KB

  • memory/2580-37-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-38-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-39-0x0000000077040000-0x0000000077065000-memory.dmp

    Filesize

    148KB

  • memory/2580-40-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-41-0x0000000074590000-0x00000000746B4000-memory.dmp

    Filesize

    1.1MB

  • memory/2580-42-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-43-0x0000000077420000-0x0000000077503000-memory.dmp

    Filesize

    908KB

  • memory/2580-44-0x0000000077730000-0x0000000077CE3000-memory.dmp

    Filesize

    5.7MB

  • memory/2580-45-0x0000000076470000-0x000000007651F000-memory.dmp

    Filesize

    700KB

  • memory/2580-46-0x0000000075A50000-0x0000000075C60000-memory.dmp

    Filesize

    2.1MB

  • memory/2580-47-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-48-0x0000000076970000-0x0000000076A4C000-memory.dmp

    Filesize

    880KB

  • memory/2580-49-0x0000000077420000-0x0000000077503000-memory.dmp

    Filesize

    908KB

  • memory/2580-50-0x0000000077730000-0x0000000077CE3000-memory.dmp

    Filesize

    5.7MB

  • memory/2580-51-0x0000000076470000-0x000000007651F000-memory.dmp

    Filesize

    700KB

  • memory/2580-15-0x0000000003A80000-0x0000000003ABC000-memory.dmp

    Filesize

    240KB

  • memory/2580-53-0x00000000759D0000-0x0000000075A44000-memory.dmp

    Filesize

    464KB

  • memory/2580-25-0x00000000773A0000-0x000000007741A000-memory.dmp

    Filesize

    488KB

  • memory/2580-54-0x0000000074590000-0x00000000746B4000-memory.dmp

    Filesize

    1.1MB

  • memory/2580-65-0x0000000077040000-0x0000000077065000-memory.dmp

    Filesize

    148KB

  • memory/2580-55-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-58-0x0000000075A50000-0x0000000075C60000-memory.dmp

    Filesize

    2.1MB

  • memory/2580-60-0x0000000074590000-0x00000000746B4000-memory.dmp

    Filesize

    1.1MB

  • memory/2580-59-0x00000000759D0000-0x0000000075A44000-memory.dmp

    Filesize

    464KB

  • memory/2580-62-0x0000000077730000-0x0000000077CE3000-memory.dmp

    Filesize

    5.7MB

  • memory/2580-63-0x0000000076470000-0x000000007651F000-memory.dmp

    Filesize

    700KB

  • memory/2580-64-0x0000000075A50000-0x0000000075C60000-memory.dmp

    Filesize

    2.1MB

  • memory/2580-56-0x0000000077730000-0x0000000077CE3000-memory.dmp

    Filesize

    5.7MB

  • memory/2580-66-0x00000000759D0000-0x0000000075A44000-memory.dmp

    Filesize

    464KB

  • memory/2580-68-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-67-0x0000000074590000-0x00000000746B4000-memory.dmp

    Filesize

    1.1MB

  • memory/2580-61-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-69-0x0000000077730000-0x0000000077CE3000-memory.dmp

    Filesize

    5.7MB

  • memory/2580-70-0x0000000076470000-0x000000007651F000-memory.dmp

    Filesize

    700KB

  • memory/2580-71-0x0000000075A50000-0x0000000075C60000-memory.dmp

    Filesize

    2.1MB

  • memory/2580-72-0x00000000759D0000-0x0000000075A44000-memory.dmp

    Filesize

    464KB

  • memory/2580-73-0x0000000074590000-0x00000000746B4000-memory.dmp

    Filesize

    1.1MB

  • memory/2580-74-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-75-0x0000000076970000-0x0000000076A4C000-memory.dmp

    Filesize

    880KB

  • memory/2580-76-0x0000000077420000-0x0000000077503000-memory.dmp

    Filesize

    908KB

  • memory/2580-77-0x0000000077730000-0x0000000077CE3000-memory.dmp

    Filesize

    5.7MB

  • memory/2580-79-0x0000000075A50000-0x0000000075C60000-memory.dmp

    Filesize

    2.1MB

  • memory/2580-81-0x0000000074590000-0x00000000746B4000-memory.dmp

    Filesize

    1.1MB

  • memory/2580-80-0x00000000759D0000-0x0000000075A44000-memory.dmp

    Filesize

    464KB

  • memory/2580-83-0x0000000077730000-0x0000000077CE3000-memory.dmp

    Filesize

    5.7MB

  • memory/2580-82-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-78-0x0000000076470000-0x000000007651F000-memory.dmp

    Filesize

    700KB

  • memory/2580-84-0x0000000075A50000-0x0000000075C60000-memory.dmp

    Filesize

    2.1MB

  • memory/2580-85-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2580-6-0x00000000007A0000-0x00000000007A1000-memory.dmp

    Filesize

    4KB

  • memory/2580-161-0x00000000007A0000-0x00000000007A1000-memory.dmp

    Filesize

    4KB