Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 03:47

General

  • Target

    457b849ab77aa59fca97484b22506966a90cc1657b1d6766a70789a3f9fe0c48.exe

  • Size

    937KB

  • MD5

    3425ee6512fd3261419c1884e7927c44

  • SHA1

    302403783d00df8d96355c108757051b040dd973

  • SHA256

    457b849ab77aa59fca97484b22506966a90cc1657b1d6766a70789a3f9fe0c48

  • SHA512

    e13e3cf116af5f084714b5283ae4a8a6cbb4ff5b59f7a8cd134dc5d50ce465779cee583c4d146469775517ff82488c3f4087c8ba73207be783b718bd82d64038

  • SSDEEP

    24576:Uyk7ho7n05eJj330Avw+xAgSwhvZwCTHOY:j0hen7Jfx4UvOCTu

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 12 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\457b849ab77aa59fca97484b22506966a90cc1657b1d6766a70789a3f9fe0c48.exe
    "C:\Users\Admin\AppData\Local\Temp\457b849ab77aa59fca97484b22506966a90cc1657b1d6766a70789a3f9fe0c48.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1757176.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1757176.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0020773.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0020773.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2636
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x7901868.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x7901868.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2768
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g2055023.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g2055023.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2784
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2824
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 268
                7⤵
                • Program crash
                PID:2548
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 272
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1757176.exe

    Filesize

    835KB

    MD5

    14680fec545ad097ae78784c46d017c7

    SHA1

    7790262bb579afba031cdbc14acb32bfc5c82164

    SHA256

    ca6c8bca33a133a015ea7f886fad77a4d02ce439ee650a2bf027eef24f84b3d3

    SHA512

    642ecaa7623d26a334afb1e4b3c30b774235e3fdc5d5b96fe1b77d33c7baaaae75d76558ef77ba29c0ba06c9d4290fe0a77d7caaded51e6e1f17c9bf652f4793

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1757176.exe

    Filesize

    835KB

    MD5

    14680fec545ad097ae78784c46d017c7

    SHA1

    7790262bb579afba031cdbc14acb32bfc5c82164

    SHA256

    ca6c8bca33a133a015ea7f886fad77a4d02ce439ee650a2bf027eef24f84b3d3

    SHA512

    642ecaa7623d26a334afb1e4b3c30b774235e3fdc5d5b96fe1b77d33c7baaaae75d76558ef77ba29c0ba06c9d4290fe0a77d7caaded51e6e1f17c9bf652f4793

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0020773.exe

    Filesize

    570KB

    MD5

    2d4f95425c919f5bc2189fa6c0510960

    SHA1

    2d9a19a01df266970b493347b7bd2b648c33608c

    SHA256

    aea23c169e0bfe411ff9af7af5a35b988049c5d7df3f3a0072b65a8569f4d7b0

    SHA512

    c7de8be5e56dbc6688dea0ff5f324229e7ffb16d3d04536e6de6aa2caa89938bc6e248b87d4464172c280e9c29d3f5824e73a79cc79798bff2c3a5be0904ee8f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0020773.exe

    Filesize

    570KB

    MD5

    2d4f95425c919f5bc2189fa6c0510960

    SHA1

    2d9a19a01df266970b493347b7bd2b648c33608c

    SHA256

    aea23c169e0bfe411ff9af7af5a35b988049c5d7df3f3a0072b65a8569f4d7b0

    SHA512

    c7de8be5e56dbc6688dea0ff5f324229e7ffb16d3d04536e6de6aa2caa89938bc6e248b87d4464172c280e9c29d3f5824e73a79cc79798bff2c3a5be0904ee8f

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x7901868.exe

    Filesize

    394KB

    MD5

    11c4bfffbf7be4f4ee354001a7f56262

    SHA1

    173108974511ad0efeac1f6184c410db8be6f2bc

    SHA256

    c593efa3913af507a0d74733608222c0ac25f9a0c75656e17dd3053652340235

    SHA512

    fa7266ceab79a9e374677ab3a9d753940210fbb3df907e7bbfea986476a200c69920729f0f81e8936c6d839ebbfc653fdfa9e5899f52ede935f14ff269e4ee6f

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x7901868.exe

    Filesize

    394KB

    MD5

    11c4bfffbf7be4f4ee354001a7f56262

    SHA1

    173108974511ad0efeac1f6184c410db8be6f2bc

    SHA256

    c593efa3913af507a0d74733608222c0ac25f9a0c75656e17dd3053652340235

    SHA512

    fa7266ceab79a9e374677ab3a9d753940210fbb3df907e7bbfea986476a200c69920729f0f81e8936c6d839ebbfc653fdfa9e5899f52ede935f14ff269e4ee6f

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g2055023.exe

    Filesize

    365KB

    MD5

    2ebe5b4f0de53f2e974e007436fb1187

    SHA1

    d6cf3720d179b621b9597927afcde51bab678830

    SHA256

    1130941f690aa7bd80afee4ef7f1c39d49d404665af63ea749671a9f5adc44e7

    SHA512

    405786c1e269685d7d0ff96776ef2511a79d50ff6969a37f7aa4660e22daaec3ed67a2f38cd59075396710c32c0e069294d4a58d6705708e0609699ae8b96956

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g2055023.exe

    Filesize

    365KB

    MD5

    2ebe5b4f0de53f2e974e007436fb1187

    SHA1

    d6cf3720d179b621b9597927afcde51bab678830

    SHA256

    1130941f690aa7bd80afee4ef7f1c39d49d404665af63ea749671a9f5adc44e7

    SHA512

    405786c1e269685d7d0ff96776ef2511a79d50ff6969a37f7aa4660e22daaec3ed67a2f38cd59075396710c32c0e069294d4a58d6705708e0609699ae8b96956

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x1757176.exe

    Filesize

    835KB

    MD5

    14680fec545ad097ae78784c46d017c7

    SHA1

    7790262bb579afba031cdbc14acb32bfc5c82164

    SHA256

    ca6c8bca33a133a015ea7f886fad77a4d02ce439ee650a2bf027eef24f84b3d3

    SHA512

    642ecaa7623d26a334afb1e4b3c30b774235e3fdc5d5b96fe1b77d33c7baaaae75d76558ef77ba29c0ba06c9d4290fe0a77d7caaded51e6e1f17c9bf652f4793

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x1757176.exe

    Filesize

    835KB

    MD5

    14680fec545ad097ae78784c46d017c7

    SHA1

    7790262bb579afba031cdbc14acb32bfc5c82164

    SHA256

    ca6c8bca33a133a015ea7f886fad77a4d02ce439ee650a2bf027eef24f84b3d3

    SHA512

    642ecaa7623d26a334afb1e4b3c30b774235e3fdc5d5b96fe1b77d33c7baaaae75d76558ef77ba29c0ba06c9d4290fe0a77d7caaded51e6e1f17c9bf652f4793

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x0020773.exe

    Filesize

    570KB

    MD5

    2d4f95425c919f5bc2189fa6c0510960

    SHA1

    2d9a19a01df266970b493347b7bd2b648c33608c

    SHA256

    aea23c169e0bfe411ff9af7af5a35b988049c5d7df3f3a0072b65a8569f4d7b0

    SHA512

    c7de8be5e56dbc6688dea0ff5f324229e7ffb16d3d04536e6de6aa2caa89938bc6e248b87d4464172c280e9c29d3f5824e73a79cc79798bff2c3a5be0904ee8f

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x0020773.exe

    Filesize

    570KB

    MD5

    2d4f95425c919f5bc2189fa6c0510960

    SHA1

    2d9a19a01df266970b493347b7bd2b648c33608c

    SHA256

    aea23c169e0bfe411ff9af7af5a35b988049c5d7df3f3a0072b65a8569f4d7b0

    SHA512

    c7de8be5e56dbc6688dea0ff5f324229e7ffb16d3d04536e6de6aa2caa89938bc6e248b87d4464172c280e9c29d3f5824e73a79cc79798bff2c3a5be0904ee8f

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x7901868.exe

    Filesize

    394KB

    MD5

    11c4bfffbf7be4f4ee354001a7f56262

    SHA1

    173108974511ad0efeac1f6184c410db8be6f2bc

    SHA256

    c593efa3913af507a0d74733608222c0ac25f9a0c75656e17dd3053652340235

    SHA512

    fa7266ceab79a9e374677ab3a9d753940210fbb3df907e7bbfea986476a200c69920729f0f81e8936c6d839ebbfc653fdfa9e5899f52ede935f14ff269e4ee6f

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x7901868.exe

    Filesize

    394KB

    MD5

    11c4bfffbf7be4f4ee354001a7f56262

    SHA1

    173108974511ad0efeac1f6184c410db8be6f2bc

    SHA256

    c593efa3913af507a0d74733608222c0ac25f9a0c75656e17dd3053652340235

    SHA512

    fa7266ceab79a9e374677ab3a9d753940210fbb3df907e7bbfea986476a200c69920729f0f81e8936c6d839ebbfc653fdfa9e5899f52ede935f14ff269e4ee6f

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g2055023.exe

    Filesize

    365KB

    MD5

    2ebe5b4f0de53f2e974e007436fb1187

    SHA1

    d6cf3720d179b621b9597927afcde51bab678830

    SHA256

    1130941f690aa7bd80afee4ef7f1c39d49d404665af63ea749671a9f5adc44e7

    SHA512

    405786c1e269685d7d0ff96776ef2511a79d50ff6969a37f7aa4660e22daaec3ed67a2f38cd59075396710c32c0e069294d4a58d6705708e0609699ae8b96956

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g2055023.exe

    Filesize

    365KB

    MD5

    2ebe5b4f0de53f2e974e007436fb1187

    SHA1

    d6cf3720d179b621b9597927afcde51bab678830

    SHA256

    1130941f690aa7bd80afee4ef7f1c39d49d404665af63ea749671a9f5adc44e7

    SHA512

    405786c1e269685d7d0ff96776ef2511a79d50ff6969a37f7aa4660e22daaec3ed67a2f38cd59075396710c32c0e069294d4a58d6705708e0609699ae8b96956

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g2055023.exe

    Filesize

    365KB

    MD5

    2ebe5b4f0de53f2e974e007436fb1187

    SHA1

    d6cf3720d179b621b9597927afcde51bab678830

    SHA256

    1130941f690aa7bd80afee4ef7f1c39d49d404665af63ea749671a9f5adc44e7

    SHA512

    405786c1e269685d7d0ff96776ef2511a79d50ff6969a37f7aa4660e22daaec3ed67a2f38cd59075396710c32c0e069294d4a58d6705708e0609699ae8b96956

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g2055023.exe

    Filesize

    365KB

    MD5

    2ebe5b4f0de53f2e974e007436fb1187

    SHA1

    d6cf3720d179b621b9597927afcde51bab678830

    SHA256

    1130941f690aa7bd80afee4ef7f1c39d49d404665af63ea749671a9f5adc44e7

    SHA512

    405786c1e269685d7d0ff96776ef2511a79d50ff6969a37f7aa4660e22daaec3ed67a2f38cd59075396710c32c0e069294d4a58d6705708e0609699ae8b96956

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g2055023.exe

    Filesize

    365KB

    MD5

    2ebe5b4f0de53f2e974e007436fb1187

    SHA1

    d6cf3720d179b621b9597927afcde51bab678830

    SHA256

    1130941f690aa7bd80afee4ef7f1c39d49d404665af63ea749671a9f5adc44e7

    SHA512

    405786c1e269685d7d0ff96776ef2511a79d50ff6969a37f7aa4660e22daaec3ed67a2f38cd59075396710c32c0e069294d4a58d6705708e0609699ae8b96956

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g2055023.exe

    Filesize

    365KB

    MD5

    2ebe5b4f0de53f2e974e007436fb1187

    SHA1

    d6cf3720d179b621b9597927afcde51bab678830

    SHA256

    1130941f690aa7bd80afee4ef7f1c39d49d404665af63ea749671a9f5adc44e7

    SHA512

    405786c1e269685d7d0ff96776ef2511a79d50ff6969a37f7aa4660e22daaec3ed67a2f38cd59075396710c32c0e069294d4a58d6705708e0609699ae8b96956

  • memory/2824-46-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2824-45-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2824-40-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2824-47-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2824-49-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2824-51-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2824-44-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2824-43-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2824-42-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2824-41-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB