Analysis
-
max time kernel
96s -
max time network
91s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
05/11/2023, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
Setup Trackspacer v2.5.9.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Setup Trackspacer v2.5.9.exe
Resource
win10v2004-20231023-en
General
-
Target
Setup Trackspacer v2.5.9.exe
-
Size
16.6MB
-
MD5
e2ce1dc7bcf0455b7f99997cc08fa775
-
SHA1
aa5576421e47360033f63cd2fc85bd493fddf73a
-
SHA256
ba3672bda29c0329cabb83c93bfbf730b2a7e04e5a5c3f186c424d2dd7f52048
-
SHA512
69efa5cf1697d1e1c5f4a7f3964fb1e0a3a5b1aefa0acc2c21aab0962c2b541f2cb7000f99d9cdc08428a06b0b9fdb4bffa235c23d2346e0a5d3da905372d145
-
SSDEEP
393216:6kVDDoB8xaSsaCGtwOPTbVhArMqhi4M0PxkxH/qLFKCSzo:dhU86AtwONhAANqkVy528
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4552 Setup Trackspacer v2.5.9.tmp -
Loads dropped DLL 5 IoCs
pid Process 4552 Setup Trackspacer v2.5.9.tmp 4552 Setup Trackspacer v2.5.9.tmp 4552 Setup Trackspacer v2.5.9.tmp 4552 Setup Trackspacer v2.5.9.tmp 4552 Setup Trackspacer v2.5.9.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4552 Setup Trackspacer v2.5.9.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1144 wrote to memory of 4552 1144 Setup Trackspacer v2.5.9.exe 89 PID 1144 wrote to memory of 4552 1144 Setup Trackspacer v2.5.9.exe 89 PID 1144 wrote to memory of 4552 1144 Setup Trackspacer v2.5.9.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup Trackspacer v2.5.9.exe"C:\Users\Admin\AppData\Local\Temp\Setup Trackspacer v2.5.9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\is-DNV21.tmp\Setup Trackspacer v2.5.9.tmp"C:\Users\Admin\AppData\Local\Temp\is-DNV21.tmp\Setup Trackspacer v2.5.9.tmp" /SL5="$6003C,16959315,230400,C:\Users\Admin\AppData\Local\Temp\Setup Trackspacer v2.5.9.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4552
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
4KB
MD5fe369a9470426cf1570198224f8922b0
SHA182cf9e81262feaa0648b20c90c88b53c9d1e9e01
SHA25675e01c305e8e28eea25dea2b4b83c3d230ee6ec4ae4fe017bc7b52292e27b961
SHA512fb31b0a0dd982f1e25f68027ae39ab2eeaeb53d570b0f60204fa058d356773c70d56fa420c12a4ee8cfaf6040be320304e16f6a8343b4b70ae231dbb3291570f
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
1.2MB
MD5f850a5e76daecad64cd1ab7a0a943ee9
SHA1bde9685038e6e26cf78670d4122997f6a4ce3ca8
SHA256f0ad561140bbe8e8ee034fdb2f5550301e1756d3beeaad45f2c6c43c98f68f03
SHA512e0492895bc07c86466a4011aea70fbff4b7c566c9875b51d2dc739c9707d9e242a4672310c5a49dd7333e53236f7d0aa7fe16d1e229fd67cc53b8e8eed20c62f