984036632b2972a808d5b301eef63a6ce6263aca90f444506efeaaadf5e89a04

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2023 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

984036632b2972a808d5b301eef63a6ce6263aca90f444506efeaaadf5e89a04.exe
Size

5.5MB
MD5

26775c7707d7fa4c6cf7fac15e5b8480
SHA1

777cdcd8b748d6c7dc889754a1e09e9fdf74d285
SHA256

984036632b2972a808d5b301eef63a6ce6263aca90f444506efeaaadf5e89a04
SHA512

ed9e0fdca1f0891003d9818b5e6818bc21af89907c9e99d46110359b267d4e2607d912b057825fb18e4a1550d6f46031397d5a755b61ac4bc874f4cb9eaef401
SSDEEP

98304:3dsRyN1BT6JI7tuaYHxnrgTY/PNN4VaQ2koJ2BfWFy2O1Um8NhsKHLIXO3jZYbdE:tsRYoe7tuaYRUM3L4VaQ2kgiWFy262kG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1696	is-T2FO1.tmp
4528	ABuster.exe
2992	ABuster.exe

Loads dropped DLL 3 IoCs

pid	Process
1696	is-T2FO1.tmp
1696	is-T2FO1.tmp
1696	is-T2FO1.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	51.159.66.125

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ABuster\Plugins\is-OAB9J.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-JRGG8.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-NO6AU.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-ISBTN.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Help\is-T6AO9.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-60192.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-OCC3S.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-Q4QM6.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Plugins\is-QCQPK.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Plugins\is-7077N.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-PNEDL.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-MD215.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\is-5IKV7.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\is-0I255.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-PH823.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-CQ5KJ.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-HGT8A.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-I77R1.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-QPI4E.tmp	is-T2FO1.tmp
File opened for modification	C:\Program Files (x86)\ABuster\ABuster.exe	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-KJDNP.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-G1HJ0.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-TUJ8E.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-RUUB2.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Online\is-CKT02.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-24THQ.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-E7KFT.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-TPLLF.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-QGVS2.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Online\is-DFB0M.tmp	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Plugins\is-9FA5J.tmp	is-T2FO1.tmp
File opened for modification	C:\Program Files (x86)\ABuster\unins000.dat	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\unins000.dat	is-T2FO1.tmp
File created	C:\Program Files (x86)\ABuster\Lang\is-1SNL4.tmp	is-T2FO1.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1696	2640	984036632b2972a808d5b301eef63a6ce6263aca90f444506efeaaadf5e89a04.exe	89
PID 2640 wrote to memory of 1696	2640	984036632b2972a808d5b301eef63a6ce6263aca90f444506efeaaadf5e89a04.exe	89
PID 2640 wrote to memory of 1696	2640	984036632b2972a808d5b301eef63a6ce6263aca90f444506efeaaadf5e89a04.exe	89
PID 1696 wrote to memory of 3100	1696	is-T2FO1.tmp	91
PID 1696 wrote to memory of 3100	1696	is-T2FO1.tmp	91
PID 1696 wrote to memory of 3100	1696	is-T2FO1.tmp	91
PID 1696 wrote to memory of 4528	1696	is-T2FO1.tmp	93
PID 1696 wrote to memory of 4528	1696	is-T2FO1.tmp	93
PID 1696 wrote to memory of 4528	1696	is-T2FO1.tmp	93
PID 3100 wrote to memory of 4604	3100	net.exe	95
PID 3100 wrote to memory of 4604	3100	net.exe	95
PID 3100 wrote to memory of 4604	3100	net.exe	95
PID 1696 wrote to memory of 2992	1696	is-T2FO1.tmp	96
PID 1696 wrote to memory of 2992	1696	is-T2FO1.tmp	96
PID 1696 wrote to memory of 2992	1696	is-T2FO1.tmp	96

C:\Users\Admin\AppData\Local\Temp\984036632b2972a808d5b301eef63a6ce6263aca90f444506efeaaadf5e89a04.exe
"C:\Users\Admin\AppData\Local\Temp\984036632b2972a808d5b301eef63a6ce6263aca90f444506efeaaadf5e89a04.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\is-IIHGF.tmp\is-T2FO1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IIHGF.tmp\is-T2FO1.tmp" /SL4 $A0118 "C:\Users\Admin\AppData\Local\Temp\984036632b2972a808d5b301eef63a6ce6263aca90f444506efeaaadf5e89a04.exe" 5464185 79360
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" helpmsg 3
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 3
      4⤵
      PID:4604
- - C:\Program Files (x86)\ABuster\ABuster.exe
    "C:\Program Files (x86)\ABuster\ABuster.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4528
- - C:\Program Files (x86)\ABuster\ABuster.exe
    "C:\Program Files (x86)\ABuster\ABuster.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ABuster\ABuster.exe

Filesize
3.8MB

MD5
19dd7c2b6456b649a976b7a036b5d23c

SHA1
9588ae84ff36f8203957c99565971a9e3bd6c737

SHA256
a504974614ee3dbc80a2734dbbe92a1205a5d512474561388016ca2e56d813d9

SHA512
7ea00ec7be1b2a7011c45cb4a576d75be3187c74047859e433046d52be645cfff7aeec751016e1e0e16d9477f09482f5a0bb92bd10545bc338eb93b2f398ab7e

Download Submit
C:\Program Files (x86)\ABuster\ABuster.exe

Filesize
3.8MB

MD5
19dd7c2b6456b649a976b7a036b5d23c

SHA1
9588ae84ff36f8203957c99565971a9e3bd6c737

SHA256
a504974614ee3dbc80a2734dbbe92a1205a5d512474561388016ca2e56d813d9

SHA512
7ea00ec7be1b2a7011c45cb4a576d75be3187c74047859e433046d52be645cfff7aeec751016e1e0e16d9477f09482f5a0bb92bd10545bc338eb93b2f398ab7e

Download Submit
C:\Program Files (x86)\ABuster\ABuster.exe

Filesize
3.8MB

MD5
19dd7c2b6456b649a976b7a036b5d23c

SHA1
9588ae84ff36f8203957c99565971a9e3bd6c737

SHA256
a504974614ee3dbc80a2734dbbe92a1205a5d512474561388016ca2e56d813d9

SHA512
7ea00ec7be1b2a7011c45cb4a576d75be3187c74047859e433046d52be645cfff7aeec751016e1e0e16d9477f09482f5a0bb92bd10545bc338eb93b2f398ab7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IIHGF.tmp\is-T2FO1.tmp

Filesize
643KB

MD5
a991510c12f20ccf8a5231a32a7958c3

SHA1
122724d1a4fdea39af3aa427e4941158d7e91dfa

SHA256
0c3ab280e156e9ff6a325267bc5d721f71dcb12490a53a03a033d932272f9198

SHA512
8f387a6189f6fa51f84004706589ed1706dfd08dfc38c1f8ce3ce010f37efac085fd241396ab69bc25c86174a4637492163bf3cb26f88639551dc9fa0c52eafa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IIHGF.tmp\is-T2FO1.tmp

Filesize
643KB

MD5
a991510c12f20ccf8a5231a32a7958c3

SHA1
122724d1a4fdea39af3aa427e4941158d7e91dfa

SHA256
0c3ab280e156e9ff6a325267bc5d721f71dcb12490a53a03a033d932272f9198

SHA512
8f387a6189f6fa51f84004706589ed1706dfd08dfc38c1f8ce3ce010f37efac085fd241396ab69bc25c86174a4637492163bf3cb26f88639551dc9fa0c52eafa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ON6I3.tmp\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ON6I3.tmp\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ON6I3.tmp\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
memory/1696-7-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/1696-100-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1696-99-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/2640-1-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2640-97-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2992-101-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-117-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-146-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-143-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-139-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-136-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-102-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-105-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-108-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-111-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-114-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-96-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-118-0x0000000000980000-0x0000000000A29000-memory.dmp

Filesize
676KB

Download
memory/2992-119-0x0000000000980000-0x0000000000A29000-memory.dmp

Filesize
676KB

Download
memory/2992-123-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-124-0x0000000000980000-0x0000000000A29000-memory.dmp

Filesize
676KB

Download
memory/2992-127-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-130-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2992-133-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/4528-88-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/4528-90-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/4528-92-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/4528-93-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download