Analysis

  • max time kernel
    32s
  • max time network
    27s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 22:48

General

  • Target

    43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe

  • Size

    956KB

  • MD5

    bc553eff5b4b8567f6691b3f345e890b

  • SHA1

    f3dfb7d6a0689549b9d924ec1972f79c49b9a96c

  • SHA256

    43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453

  • SHA512

    99019020e34df2ee3b7fc32cdd4db53e8eda933d653d2a02933bb52bf1627a63be789abe914159331d41eb6e14b83286aac4ac9de2c1fddef1073cafc617186b

  • SSDEEP

    24576:KyolDkDv+9yI4KGT6QImxABsPh1xS0vWQwaOAIPfMS:RYkYyIFwR1TxBE

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe
    "C:\Users\Admin\AppData\Local\Temp\43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9643145.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9643145.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3806825.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3806825.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2960
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9683513.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9683513.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2756
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2544
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:2680
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2564
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 268
                  7⤵
                  • Program crash
                  PID:3032
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 280
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2632

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9643145.exe

      Filesize

      854KB

      MD5

      890333ca9002375508504fcb648ac858

      SHA1

      a38e843e37293f159e855b08a23efa19d3a80272

      SHA256

      0d4035174eac18016c596518166c080019dc4ca4d6431517d4eba610366630fa

      SHA512

      97965d7a1f455441b1c6334fff5bf42769bf0743e33020c6d1702b9887442f8f53f924543e7f727488b55cea70f09fd82e645040f8a9715111cf92da3d66016c

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9643145.exe

      Filesize

      854KB

      MD5

      890333ca9002375508504fcb648ac858

      SHA1

      a38e843e37293f159e855b08a23efa19d3a80272

      SHA256

      0d4035174eac18016c596518166c080019dc4ca4d6431517d4eba610366630fa

      SHA512

      97965d7a1f455441b1c6334fff5bf42769bf0743e33020c6d1702b9887442f8f53f924543e7f727488b55cea70f09fd82e645040f8a9715111cf92da3d66016c

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3806825.exe

      Filesize

      580KB

      MD5

      693c13b73b88d3a0b0700b46e9968354

      SHA1

      bee93506fd55ef121a60de7f54ea56b1564c70d0

      SHA256

      16a4f73018248b3856e5b57f6257b3c947c35f640b74841cd05c6e20638cf74c

      SHA512

      98b650f26aa0e5eb6a8d22e65a5d6a6d48202b72cb050f70d337f4e8ca9c131736bf936a5a257632bd3eee01c45b160c0f0a61aa6b98271d95e44257d0aba75d

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3806825.exe

      Filesize

      580KB

      MD5

      693c13b73b88d3a0b0700b46e9968354

      SHA1

      bee93506fd55ef121a60de7f54ea56b1564c70d0

      SHA256

      16a4f73018248b3856e5b57f6257b3c947c35f640b74841cd05c6e20638cf74c

      SHA512

      98b650f26aa0e5eb6a8d22e65a5d6a6d48202b72cb050f70d337f4e8ca9c131736bf936a5a257632bd3eee01c45b160c0f0a61aa6b98271d95e44257d0aba75d

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9683513.exe

      Filesize

      404KB

      MD5

      5fc9ce5165093ee758aab5555afd5ad0

      SHA1

      c4057c14f8ac5df3f4c6d3a1445bf641ba4dfed1

      SHA256

      57b841463b196aea4b9a71597786cd94847c0f6c945e404d418e5582c432316b

      SHA512

      900a9f64c2d30dd687ec680551e874dcc08127246ef72965a4599009e6c31e3134bb67e1ead669869d0f353d59c45acd6e48784432ab624783f371994fe9f733

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9683513.exe

      Filesize

      404KB

      MD5

      5fc9ce5165093ee758aab5555afd5ad0

      SHA1

      c4057c14f8ac5df3f4c6d3a1445bf641ba4dfed1

      SHA256

      57b841463b196aea4b9a71597786cd94847c0f6c945e404d418e5582c432316b

      SHA512

      900a9f64c2d30dd687ec680551e874dcc08127246ef72965a4599009e6c31e3134bb67e1ead669869d0f353d59c45acd6e48784432ab624783f371994fe9f733

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exe

      Filesize

      396KB

      MD5

      990f876fb678a1a40e7278c90be60411

      SHA1

      f193c3018da9e115ed2d122de9f7dd8f4d053437

      SHA256

      3da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b

      SHA512

      ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exe

      Filesize

      396KB

      MD5

      990f876fb678a1a40e7278c90be60411

      SHA1

      f193c3018da9e115ed2d122de9f7dd8f4d053437

      SHA256

      3da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b

      SHA512

      ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exe

      Filesize

      396KB

      MD5

      990f876fb678a1a40e7278c90be60411

      SHA1

      f193c3018da9e115ed2d122de9f7dd8f4d053437

      SHA256

      3da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b

      SHA512

      ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x9643145.exe

      Filesize

      854KB

      MD5

      890333ca9002375508504fcb648ac858

      SHA1

      a38e843e37293f159e855b08a23efa19d3a80272

      SHA256

      0d4035174eac18016c596518166c080019dc4ca4d6431517d4eba610366630fa

      SHA512

      97965d7a1f455441b1c6334fff5bf42769bf0743e33020c6d1702b9887442f8f53f924543e7f727488b55cea70f09fd82e645040f8a9715111cf92da3d66016c

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x9643145.exe

      Filesize

      854KB

      MD5

      890333ca9002375508504fcb648ac858

      SHA1

      a38e843e37293f159e855b08a23efa19d3a80272

      SHA256

      0d4035174eac18016c596518166c080019dc4ca4d6431517d4eba610366630fa

      SHA512

      97965d7a1f455441b1c6334fff5bf42769bf0743e33020c6d1702b9887442f8f53f924543e7f727488b55cea70f09fd82e645040f8a9715111cf92da3d66016c

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x3806825.exe

      Filesize

      580KB

      MD5

      693c13b73b88d3a0b0700b46e9968354

      SHA1

      bee93506fd55ef121a60de7f54ea56b1564c70d0

      SHA256

      16a4f73018248b3856e5b57f6257b3c947c35f640b74841cd05c6e20638cf74c

      SHA512

      98b650f26aa0e5eb6a8d22e65a5d6a6d48202b72cb050f70d337f4e8ca9c131736bf936a5a257632bd3eee01c45b160c0f0a61aa6b98271d95e44257d0aba75d

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x3806825.exe

      Filesize

      580KB

      MD5

      693c13b73b88d3a0b0700b46e9968354

      SHA1

      bee93506fd55ef121a60de7f54ea56b1564c70d0

      SHA256

      16a4f73018248b3856e5b57f6257b3c947c35f640b74841cd05c6e20638cf74c

      SHA512

      98b650f26aa0e5eb6a8d22e65a5d6a6d48202b72cb050f70d337f4e8ca9c131736bf936a5a257632bd3eee01c45b160c0f0a61aa6b98271d95e44257d0aba75d

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x9683513.exe

      Filesize

      404KB

      MD5

      5fc9ce5165093ee758aab5555afd5ad0

      SHA1

      c4057c14f8ac5df3f4c6d3a1445bf641ba4dfed1

      SHA256

      57b841463b196aea4b9a71597786cd94847c0f6c945e404d418e5582c432316b

      SHA512

      900a9f64c2d30dd687ec680551e874dcc08127246ef72965a4599009e6c31e3134bb67e1ead669869d0f353d59c45acd6e48784432ab624783f371994fe9f733

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x9683513.exe

      Filesize

      404KB

      MD5

      5fc9ce5165093ee758aab5555afd5ad0

      SHA1

      c4057c14f8ac5df3f4c6d3a1445bf641ba4dfed1

      SHA256

      57b841463b196aea4b9a71597786cd94847c0f6c945e404d418e5582c432316b

      SHA512

      900a9f64c2d30dd687ec680551e874dcc08127246ef72965a4599009e6c31e3134bb67e1ead669869d0f353d59c45acd6e48784432ab624783f371994fe9f733

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exe

      Filesize

      396KB

      MD5

      990f876fb678a1a40e7278c90be60411

      SHA1

      f193c3018da9e115ed2d122de9f7dd8f4d053437

      SHA256

      3da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b

      SHA512

      ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exe

      Filesize

      396KB

      MD5

      990f876fb678a1a40e7278c90be60411

      SHA1

      f193c3018da9e115ed2d122de9f7dd8f4d053437

      SHA256

      3da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b

      SHA512

      ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exe

      Filesize

      396KB

      MD5

      990f876fb678a1a40e7278c90be60411

      SHA1

      f193c3018da9e115ed2d122de9f7dd8f4d053437

      SHA256

      3da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b

      SHA512

      ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exe

      Filesize

      396KB

      MD5

      990f876fb678a1a40e7278c90be60411

      SHA1

      f193c3018da9e115ed2d122de9f7dd8f4d053437

      SHA256

      3da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b

      SHA512

      ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exe

      Filesize

      396KB

      MD5

      990f876fb678a1a40e7278c90be60411

      SHA1

      f193c3018da9e115ed2d122de9f7dd8f4d053437

      SHA256

      3da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b

      SHA512

      ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exe

      Filesize

      396KB

      MD5

      990f876fb678a1a40e7278c90be60411

      SHA1

      f193c3018da9e115ed2d122de9f7dd8f4d053437

      SHA256

      3da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b

      SHA512

      ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exe

      Filesize

      396KB

      MD5

      990f876fb678a1a40e7278c90be60411

      SHA1

      f193c3018da9e115ed2d122de9f7dd8f4d053437

      SHA256

      3da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b

      SHA512

      ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084

    • memory/2564-47-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2564-54-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2564-44-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2564-43-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2564-56-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2564-58-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2564-49-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2564-53-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/2564-51-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2564-45-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB