Analysis
-
max time kernel
152s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
30/08/2023, 17:39
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230703-en
General
-
Target
tmp.exe
-
Size
65.1MB
-
MD5
0032cf9b48ee2a82c039e273c410ec28
-
SHA1
30bf8f8c55e165c5dd618a303b7a7db4527df54a
-
SHA256
350773db484892bc85b1d453d10a1e9c8f2405ab2de643561a952366fca1d48c
-
SHA512
565ac5e5867838a92930cc8ddf5e02e262343539f07076cb912a120df12180e59ea403d745ca7d35fa7fe4b4d22bcb2d7dc83a10d7ab3926125d8e6d3fb906bf
-
SSDEEP
1572864:glApvY5jlYCEFhq6Vy5gjFPDST/Ds5tG87FcEYkudPK/zVZ66p:9vY5KZqqy5gRWHQd9cPEzV1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2580 tmp.tmp -
Loads dropped DLL 5 IoCs
pid Process 2580 tmp.tmp 2580 tmp.tmp 2580 tmp.tmp 2580 tmp.tmp 2580 tmp.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2580 tmp.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2580 2412 tmp.exe 83 PID 2412 wrote to memory of 2580 2412 tmp.exe 83 PID 2412 wrote to memory of 2580 2412 tmp.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\is-H9NAM.tmp\tmp.tmp"C:\Users\Admin\AppData\Local\Temp\is-H9NAM.tmp\tmp.tmp" /SL5="$60062,67977372,68608,C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2580
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
624KB
MD532a4c49ff3b8b4b8a8831e6d70ccbeaa
SHA1dda5601b8e100a5091e6898bb3d23e1b68833c51
SHA256157f7e47a9f7ed38ce35bef17606ff1026fe49ef8a71fb840c088d92fe6d36bd
SHA512d8113e949c3f9e15904215f4bda825e7d2d11a4e96279c9e6421c96ebb8c05bf16e2114d735bd4fd2dce8f1a75fe6f6cdda3116bbdcaf6d821f0336849a5ca64
-
Filesize
624KB
MD532a4c49ff3b8b4b8a8831e6d70ccbeaa
SHA1dda5601b8e100a5091e6898bb3d23e1b68833c51
SHA256157f7e47a9f7ed38ce35bef17606ff1026fe49ef8a71fb840c088d92fe6d36bd
SHA512d8113e949c3f9e15904215f4bda825e7d2d11a4e96279c9e6421c96ebb8c05bf16e2114d735bd4fd2dce8f1a75fe6f6cdda3116bbdcaf6d821f0336849a5ca64
-
Filesize
385KB
MD592c2e247392e0e02261dea67e1bb1a5e
SHA1db72fed8771364bf8039b2bc83ed01dda2908554
SHA25625fdb94e386f8a41f10aba00ed092a91b878339f8e256a7252b11169122b0a68
SHA512e938d2a1870ccb437d818b5301e6ecffaa6efbf4f0122e1a1ae0981057d7d0376039ea927c6fd326456da2d6904803fca26b87245367a4c5de2aebc47bdcd4b5
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
Filesize
703KB
MD5f5372e78e27904257b5bfcf445bfab16
SHA19d85663b029796db96163ac454fba73ccdb86989
SHA2569f949b582d84d0d8d735cc32d6a91bb9a07ab0f23dbd02dedb2b7631f1787996
SHA512b69ac8afd4134649bc8334ea0064af03b9bdb8cd6ad3a6c44dff7b15c8610b45398eaf8a84ca13a3745aeecd3ae3c3147210458fce36989cecf0bc67fadc2941