19973b1a37f7c1667fa424dddaba182fcc3eff26d02cc33ae89099f0ecd3be2e

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05/09/2023, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe
Size 2.4MB
Sample230905-d2hmhsdc76
SHA256 19973b1a37f7c1667fa424dddaba182fcc3eff26d02cc33ae89099f0ecd3be2e
MD5 885d9f6b5e3085fa639ffed43aefde24
SHA1 8e16f20bddb67f7f5cf24d0f163c15f010d7a9e5
SHA512 1c78fd23ffcdadbcd8e3fa459eebc5a769f8cb2f60413915583b8c90df9b9409e21656a6366a2fcd48afa6caf38f96126924aed800ec6b60a10c5e5dec156044
SSDEEP 49152:rLL6ygW0dd+VfFU7fVs6T6+3FIw+6sVqGRWoJ3F:rSEU7fpleoKJF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
2872	rundll32.exe
2872	rundll32.exe
2872	rundll32.exe
2872	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2984	2988	SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe	28
PID 2988 wrote to memory of 2984	2988	SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe	28
PID 2988 wrote to memory of 2984	2988	SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe	28
PID 2988 wrote to memory of 2984	2988	SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe	28
PID 2984 wrote to memory of 2192	2984	control.exe	29
PID 2984 wrote to memory of 2192	2984	control.exe	29
PID 2984 wrote to memory of 2192	2984	control.exe	29
PID 2984 wrote to memory of 2192	2984	control.exe	29
PID 2984 wrote to memory of 2192	2984	control.exe	29
PID 2984 wrote to memory of 2192	2984	control.exe	29
PID 2984 wrote to memory of 2192	2984	control.exe	29
PID 2192 wrote to memory of 2560	2192	rundll32.exe	30
PID 2192 wrote to memory of 2560	2192	rundll32.exe	30
PID 2192 wrote to memory of 2560	2192	rundll32.exe	30
PID 2192 wrote to memory of 2560	2192	rundll32.exe	30
PID 2560 wrote to memory of 2872	2560	RunDll32.exe	31
PID 2560 wrote to memory of 2872	2560	RunDll32.exe	31
PID 2560 wrote to memory of 2872	2560	RunDll32.exe	31
PID 2560 wrote to memory of 2872	2560	RunDll32.exe	31
PID 2560 wrote to memory of 2872	2560	RunDll32.exe	31
PID 2560 wrote to memory of 2872	2560	RunDll32.exe	31
PID 2560 wrote to memory of 2872	2560	RunDll32.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl",
        5⤵
        Loads dropped DLL
        
        PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fYc3Bx0.cpl

Path C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fYc3Bx0.cpl

Path \Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fYc3Bx0.cpl

Path \Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fYc3Bx0.cpl

Path \Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fYc3Bx0.cpl

Path \Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fYc3Bx0.cpl

Path \Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fYc3Bx0.cpl

Path \Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fYc3Bx0.cpl

Path \Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fYc3Bx0.cpl

Path \Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2192-18-0x00000000028B0000-0x0000000002989000-memory.dmp

Download

memory/2192-8-0x0000000002100000-0x000000000230E000-memory.dmp

Download

memory/2192-17-0x00000000028B0000-0x0000000002989000-memory.dmp

Download

memory/2192-14-0x00000000028B0000-0x0000000002989000-memory.dmp

Download

memory/2192-13-0x00000000027B0000-0x00000000028A1000-memory.dmp

Download

memory/2192-9-0x00000000001F0000-0x00000000001F6000-memory.dmp

Download

memory/2192-10-0x0000000002100000-0x000000000230E000-memory.dmp

Download

memory/2192-15-0x00000000028B0000-0x0000000002989000-memory.dmp

Download

memory/2872-23-0x00000000020D0000-0x00000000022DE000-memory.dmp

Download

memory/2872-24-0x00000000020D0000-0x00000000022DE000-memory.dmp

Download

memory/2872-25-0x0000000000320000-0x0000000000326000-memory.dmp

Download

memory/2872-28-0x00000000028D0000-0x00000000029C1000-memory.dmp

Download

memory/2872-30-0x00000000029D0000-0x0000000002AA9000-memory.dmp

Download

memory/2872-32-0x00000000029D0000-0x0000000002AA9000-memory.dmp

Download

memory/2872-33-0x00000000029D0000-0x0000000002AA9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads