89c63da10876200e525b11c6fa4f9b8896185bb92feb96ba56a4918434481535

General

Target

FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.exe
Size

995KB
MD5

bfd3a7b90916948baa130eaa72d0cbc5
SHA1

9129d612ddb11ac611fe8daeed4947db72653031
SHA256

89c63da10876200e525b11c6fa4f9b8896185bb92feb96ba56a4918434481535
SHA512

b9a92de1de352aa9d765f47847320605727b060f930d476e23614909878427851e65e0849a5deb49103b673a75e1192c79bec2e5dad51ff0d28c1a66e26e6c9b
SSDEEP

12288:SSxG0lssKssVs91x888888888888W88888888888LY1e0mXtlNszhSvsvXBIJ3Hi:ZxGOjYOtlvvsvXB+3HI1Vsr3M

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5108	FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.tmp

Loads dropped DLL 3 IoCs

pid	Process
5108	FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.tmp
5108	FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.tmp
5108	FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.tmp

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	39	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	46	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 5108	928	FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.exe	86
PID 928 wrote to memory of 5108	928	FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.exe	86
PID 928 wrote to memory of 5108	928	FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.exe	86
PID 5108 wrote to memory of 3308	5108	FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.tmp	97
PID 5108 wrote to memory of 3308	5108	FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.tmp	97
PID 5108 wrote to memory of 3308	5108	FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.tmp	97

C:\Users\Admin\AppData\Local\Temp\FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.exe
"C:\Users\Admin\AppData\Local\Temp\FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Users\Admin\AppData\Local\Temp\is-JROOA.tmp\FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JROOA.tmp\FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.tmp" /SL5="$901CA,492391,402432,C:\Users\Admin\AppData\Local\Temp\FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C "ver > "C:\Users\Admin\AppData\Local\Temp\is-HIVOF.tmp\~execwithresult.txt""
    3⤵
    PID:3308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-HIVOF.tmp\freemake_dl.dll

Filesize
131KB

MD5
109e73481165f75361514240d3a95299

SHA1
babfc67686a998945b14859044626298e67f777a

SHA256
2261f0a35c85e398b294f93582001862aeb9536456a8ed4aaa08b91c69771e77

SHA512
d49806975210143045389d88a9aff66d92906fd90892fff3cc5cdb08366b118001d8f147ba312a561fa383d827dc3a9c657886e82555af1e4b704fbebf9d9aaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HIVOF.tmp\itdownload.dll

Filesize
77KB

MD5
b4efe1200f09cbf02f0d2ae326a84f3b

SHA1
83102a7f5465a14c78d04ca6d8703c68a5c599ce

SHA256
6bd9984dd28ce8cc13e8eb3b5ee9f6c8a6967e3b2288918665e2ae67fa1eb56b

SHA512
14c83df5ca8ce92efddb07bda1c6fff9cfbbfb1348ff6c2e6b523110bb1fd10023e09986bc7967824a5cf37789080d81f2a5deedc3df3925825f73e2a87b52a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HIVOF.tmp\itdownload.dll

Filesize
77KB

MD5
b4efe1200f09cbf02f0d2ae326a84f3b

SHA1
83102a7f5465a14c78d04ca6d8703c68a5c599ce

SHA256
6bd9984dd28ce8cc13e8eb3b5ee9f6c8a6967e3b2288918665e2ae67fa1eb56b

SHA512
14c83df5ca8ce92efddb07bda1c6fff9cfbbfb1348ff6c2e6b523110bb1fd10023e09986bc7967824a5cf37789080d81f2a5deedc3df3925825f73e2a87b52a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HIVOF.tmp\~execwithresult.txt

Filesize
47B

MD5
1a1ea0c1a7df5f91ecd62cda837a3273

SHA1
f358bcfc14b04949db83e04c4e181f526b3fc5f3

SHA256
9fea0616868155973e2b5ca5d1524359e47916e8aee14dfad123b533c737ee76

SHA512
666a013157c5544ef7ebad000d6a5e0f2b4020bb7e7d8792880b7c35c662b1c710e25a8893f75b8599cba5bb934c18f91a689f0f24c53b287e601475b1ae9f01

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JROOA.tmp\FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.tmp

Filesize
1.4MB

MD5
7e4aa70d53b36013428377346e0e268c

SHA1
b45756feef67b76d1d0caa459f035c3c115d4b0e

SHA256
642553254d18fbca9150d18b8189a502fed5f9e625a7fc58d3aafabb16a76893

SHA512
1b23c1f532327c3006225f345251a907875699c063bc3a47843b8ceb67b473f5404d4df50543a15d6fac002c7109eaa155c0f00c017182b93d71208e6e3180b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JROOA.tmp\FreemakeVideoDownloaderSetup_ac990394-6077-bdce-6a8c-d1de8ed2575f.tmp

Filesize
1.4MB

MD5
7e4aa70d53b36013428377346e0e268c

SHA1
b45756feef67b76d1d0caa459f035c3c115d4b0e

SHA256
642553254d18fbca9150d18b8189a502fed5f9e625a7fc58d3aafabb16a76893

SHA512
1b23c1f532327c3006225f345251a907875699c063bc3a47843b8ceb67b473f5404d4df50543a15d6fac002c7109eaa155c0f00c017182b93d71208e6e3180b8

Download Submit
memory/928-1-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/928-26-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5108-7-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/5108-16-0x0000000003350000-0x0000000003368000-memory.dmp

Filesize
96KB

Download
memory/5108-28-0x0000000000400000-0x0000000000570000-memory.dmp

Filesize
1.4MB

Download
memory/5108-29-0x0000000003350000-0x0000000003368000-memory.dmp

Filesize
96KB

Download
memory/5108-30-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing