Overview

overview

7

Static

static

5

3138e1515e...73.exe

windows7-x64

7

3138e1515e...73.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    171s
  • max time network
    189s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2023 16:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe

  • Size

    3.8MB

  • MD5

    7c82e11fdfca5afdf8202f0034389d26

  • SHA1

    6ef1177acc811c4023264e4377031fe07b764758

  • SHA256

    3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73

  • SHA512

    7d7be97a817a63b351858e397d3dedd0e3d9c2d387590a8ee786e010dfa64fa3af55c90640d6c9b4c3b86475ea0829b36d4abef2f11f25f4325a3a98c2058f68

  • SSDEEP

    49152:sw80cTsjkWakawTeeiTqK6hpMkQVOh+bSdXAkt9510MP3cqBCqgIcCE7mK+IW1IS:t8sjkUHziP+pMrwgbcDD5N3cqBh1Ie6

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe
    "C:\Users\Admin\AppData\Local\Temp\3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3640
    • C:\Users\Admin\AppData\Local\Temp\Rainmeter\Rainmeter.exe
      C:\Users\Admin\AppData\Local\Temp\Rainmeter\Rainmeter.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1892
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 652
        3⤵
        • Program crash
        PID:3884
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1892 -ip 1892
    1⤵
      PID:4500

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Rainmeter\Languages\2052.dll
      Filesize

      7KB

      MD5

      c13ac91ec49a272275cf0c42ef9abd39

      SHA1

      eaf6d697fd5da1c29ef83cc8f74d70ecff718510

      SHA256

      3e50dbf35add52b599bfc5ad4d1beeee97e58d02d70a670ccea36ea49c099755

      SHA512

      3a8d3d2d54ec35fec17838b123cfbc45359fcf46edd880fc213a647537c616bc0462844faff2893b9d49b9585092f9d6797f0f78a9ece1a8d4a7a992b1c21364

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Rainmeter\Rainmeter.data
      Filesize

      124B

      MD5

      0af93da5bdd604bf4af58180d7dc01cf

      SHA1

      c196209d49f13647bee417063eb31e9cb8ed6b44

      SHA256

      da7040b616c35d986601167facb785c44745bb07960a67f0e86c1dff4cb030ea

      SHA512

      a8d2c225dfaaece2c6e63fee5a124c82860e6dd50731ebac2701e8b9b66059fec48abd120e742383136f248835d0368e2aee86c4b2e45b8a3ff4a69dfed5e74c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Rainmeter\Rainmeter.data
      Filesize

      124B

      MD5

      0af93da5bdd604bf4af58180d7dc01cf

      SHA1

      c196209d49f13647bee417063eb31e9cb8ed6b44

      SHA256

      da7040b616c35d986601167facb785c44745bb07960a67f0e86c1dff4cb030ea

      SHA512

      a8d2c225dfaaece2c6e63fee5a124c82860e6dd50731ebac2701e8b9b66059fec48abd120e742383136f248835d0368e2aee86c4b2e45b8a3ff4a69dfed5e74c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Rainmeter\Rainmeter.dll
      Filesize

      1.9MB

      MD5

      a2eb58b4a50252c1c0cb7e07173d5b88

      SHA1

      5e179fe775e8a0bacc7d4640d1be7d1de0db5862

      SHA256

      cfe3c39bbc8b82c4f534ae6a7e4c9db80e2de4b29c22a973b7ddb789166389fc

      SHA512

      5b8c6d9175efd89de712c3f5888eb03c71bef1aadedfa6587d9c40a7cef1c1c6efcc7f5621c5ebdf04cb708d9fcad4224f6f4e45dfd6eebfa2c0e03d58409306

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Rainmeter\Rainmeter.dll
      Filesize

      1.9MB

      MD5

      a2eb58b4a50252c1c0cb7e07173d5b88

      SHA1

      5e179fe775e8a0bacc7d4640d1be7d1de0db5862

      SHA256

      cfe3c39bbc8b82c4f534ae6a7e4c9db80e2de4b29c22a973b7ddb789166389fc

      SHA512

      5b8c6d9175efd89de712c3f5888eb03c71bef1aadedfa6587d9c40a7cef1c1c6efcc7f5621c5ebdf04cb708d9fcad4224f6f4e45dfd6eebfa2c0e03d58409306

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Rainmeter\Rainmeter.exe
      Filesize

      464KB

      MD5

      0881a58b05284c3bfdf0b361b0e9b8f4

      SHA1

      cdc0f380164fe3e4eafbdcd408fb7527a359d163

      SHA256

      06e6ac93c84fec7ffdb99d9712556607a2e5e1fd8d066521e3ac06cb60e58fb6

      SHA512

      e6242e2cae9f069035c09dc766668e5d83010b776daff41a4b3cabf5e16b6ccac87ceb39fb50fdf2e0157e2393453a12ca1560103ab5eae6207410591be6d4a5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Rainmeter\Rainmeter.exe
      Filesize

      464KB

      MD5

      0881a58b05284c3bfdf0b361b0e9b8f4

      SHA1

      cdc0f380164fe3e4eafbdcd408fb7527a359d163

      SHA256

      06e6ac93c84fec7ffdb99d9712556607a2e5e1fd8d066521e3ac06cb60e58fb6

      SHA512

      e6242e2cae9f069035c09dc766668e5d83010b776daff41a4b3cabf5e16b6ccac87ceb39fb50fdf2e0157e2393453a12ca1560103ab5eae6207410591be6d4a5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Rainmeter\Rainmeter.ini
      Filesize

      1KB

      MD5

      776f7f9763feb9a0d0307e9f1235f16b

      SHA1

      9f7809ba94928f74ff080a6bbda0445da071f9e7

      SHA256

      95790e2b78540f7a1a81dea781a9e76968ec23167bc35393c8bd28e4acaa96af

      SHA512

      c5a9cd6688ff18df8ada0447685e6ada6d844b93f7bd58571c7e0d0f7959e4bf56b20df6d833974ec0402ddeac3f1e7a758d9435c9291a2f82a63e387b45e5e4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Rainmeter\Rainmeter.ini
      Filesize

      1KB

      MD5

      a5fca9353d903ffd1056f9dfeae06f79

      SHA1

      65d98987830fdf24aa9e06cea4f912b13fa48490

      SHA256

      516cb3fa4c42d8f98c70f4a88879030313c2ad135b69375ac6d378d7d6e747ed

      SHA512

      8d23cd8459a8e25f0c607757c5b26bac0272adecd0e74dc23fce1780552966a0b02ce5cdc89c6212c12029c0d5c60c944114775703254246e12e57dca0972e62

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Rainmeter\Rainmeter.stats
      Filesize

      415B

      MD5

      380d62ed3c0e0cb79d1582a0cf7bfc5c

      SHA1

      8e6ebe6ebf66352d09cb47a3dee7d72547dec20b

      SHA256

      e912bd1f028a1824c640d507111095b130c86b74ed472435ed31ee1f14758eac

      SHA512

      d3fa452728e1185ab3f4b166c5490dfcc82056b6983a7dea2a68ec167605a84b022166cab2302159e7df7ec3a94c434a95adc83fd05f50aa0781a0866f32585e

      Download Submit