Analysis

  • max time kernel
    96s
  • max time network
    91s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2023, 22:50

General

  • Target

    Setup Trackspacer v2.5.9.exe

  • Size

    16.6MB

  • MD5

    e2ce1dc7bcf0455b7f99997cc08fa775

  • SHA1

    aa5576421e47360033f63cd2fc85bd493fddf73a

  • SHA256

    ba3672bda29c0329cabb83c93bfbf730b2a7e04e5a5c3f186c424d2dd7f52048

  • SHA512

    69efa5cf1697d1e1c5f4a7f3964fb1e0a3a5b1aefa0acc2c21aab0962c2b541f2cb7000f99d9cdc08428a06b0b9fdb4bffa235c23d2346e0a5d3da905372d145

  • SSDEEP

    393216:6kVDDoB8xaSsaCGtwOPTbVhArMqhi4M0PxkxH/qLFKCSzo:dhU86AtwONhAANqkVy528

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup Trackspacer v2.5.9.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup Trackspacer v2.5.9.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Users\Admin\AppData\Local\Temp\is-DNV21.tmp\Setup Trackspacer v2.5.9.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DNV21.tmp\Setup Trackspacer v2.5.9.tmp" /SL5="$6003C,16959315,230400,C:\Users\Admin\AppData\Local\Temp\Setup Trackspacer v2.5.9.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:4552

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\is-3U35P.tmp\ISSKINU.DLL

          Filesize

          357KB

          MD5

          f30afccd6fafc1cad4567ada824c9358

          SHA1

          60a65b72f208563f90fba0da6af013a36707caa9

          SHA256

          e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d

          SHA512

          59b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c

        • C:\Users\Admin\AppData\Local\Temp\is-3U35P.tmp\ISSKINU.DLL

          Filesize

          357KB

          MD5

          f30afccd6fafc1cad4567ada824c9358

          SHA1

          60a65b72f208563f90fba0da6af013a36707caa9

          SHA256

          e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d

          SHA512

          59b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c

        • C:\Users\Admin\AppData\Local\Temp\is-3U35P.tmp\R2RINNO.dll

          Filesize

          4KB

          MD5

          fe369a9470426cf1570198224f8922b0

          SHA1

          82cf9e81262feaa0648b20c90c88b53c9d1e9e01

          SHA256

          75e01c305e8e28eea25dea2b4b83c3d230ee6ec4ae4fe017bc7b52292e27b961

          SHA512

          fb31b0a0dd982f1e25f68027ae39ab2eeaeb53d570b0f60204fa058d356773c70d56fa420c12a4ee8cfaf6040be320304e16f6a8343b4b70ae231dbb3291570f

        • C:\Users\Admin\AppData\Local\Temp\is-3U35P.tmp\SKIN.CJSTYLES

          Filesize

          813KB

          MD5

          5f87caf3f7cf63dde8e6af53bdf31289

          SHA1

          a2c3cc3d9d831acd797155b667db59a32000d7a8

          SHA256

          4731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940

          SHA512

          4875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d

        • C:\Users\Admin\AppData\Local\Temp\is-3U35P.tmp\SKIN.CJSTYLES

          Filesize

          813KB

          MD5

          5f87caf3f7cf63dde8e6af53bdf31289

          SHA1

          a2c3cc3d9d831acd797155b667db59a32000d7a8

          SHA256

          4731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940

          SHA512

          4875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d

        • C:\Users\Admin\AppData\Local\Temp\is-DNV21.tmp\Setup Trackspacer v2.5.9.tmp

          Filesize

          1.2MB

          MD5

          f850a5e76daecad64cd1ab7a0a943ee9

          SHA1

          bde9685038e6e26cf78670d4122997f6a4ce3ca8

          SHA256

          f0ad561140bbe8e8ee034fdb2f5550301e1756d3beeaad45f2c6c43c98f68f03

          SHA512

          e0492895bc07c86466a4011aea70fbff4b7c566c9875b51d2dc739c9707d9e242a4672310c5a49dd7333e53236f7d0aa7fe16d1e229fd67cc53b8e8eed20c62f

        • memory/1144-1-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/1144-72-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/4552-48-0x0000000075C50000-0x0000000075D33000-memory.dmp

          Filesize

          908KB

        • memory/4552-53-0x0000000074190000-0x00000000742B2000-memory.dmp

          Filesize

          1.1MB

        • memory/4552-24-0x00000000771E0000-0x000000007725A000-memory.dmp

          Filesize

          488KB

        • memory/4552-25-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-26-0x00000000771E0000-0x000000007725A000-memory.dmp

          Filesize

          488KB

        • memory/4552-27-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-28-0x00000000771E0000-0x000000007725A000-memory.dmp

          Filesize

          488KB

        • memory/4552-29-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-30-0x00000000771E0000-0x000000007725A000-memory.dmp

          Filesize

          488KB

        • memory/4552-31-0x00000000768E0000-0x0000000076905000-memory.dmp

          Filesize

          148KB

        • memory/4552-32-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-33-0x00000000771E0000-0x000000007725A000-memory.dmp

          Filesize

          488KB

        • memory/4552-34-0x00000000768E0000-0x0000000076905000-memory.dmp

          Filesize

          148KB

        • memory/4552-35-0x0000000074350000-0x0000000074380000-memory.dmp

          Filesize

          192KB

        • memory/4552-36-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-38-0x00000000768E0000-0x0000000076905000-memory.dmp

          Filesize

          148KB

        • memory/4552-37-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-39-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-40-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-41-0x0000000075C50000-0x0000000075D33000-memory.dmp

          Filesize

          908KB

        • memory/4552-42-0x0000000075050000-0x0000000075260000-memory.dmp

          Filesize

          2.1MB

        • memory/4552-43-0x0000000076090000-0x0000000076643000-memory.dmp

          Filesize

          5.7MB

        • memory/4552-44-0x0000000076B30000-0x0000000076BDF000-memory.dmp

          Filesize

          700KB

        • memory/4552-45-0x0000000074190000-0x00000000742B2000-memory.dmp

          Filesize

          1.1MB

        • memory/4552-46-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-47-0x0000000075B70000-0x0000000075C4C000-memory.dmp

          Filesize

          880KB

        • memory/4552-15-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-49-0x0000000075050000-0x0000000075260000-memory.dmp

          Filesize

          2.1MB

        • memory/4552-50-0x0000000076090000-0x0000000076643000-memory.dmp

          Filesize

          5.7MB

        • memory/4552-51-0x0000000076B30000-0x0000000076BDF000-memory.dmp

          Filesize

          700KB

        • memory/4552-52-0x0000000074FD0000-0x0000000075044000-memory.dmp

          Filesize

          464KB

        • memory/4552-18-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-54-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-55-0x0000000075050000-0x0000000075260000-memory.dmp

          Filesize

          2.1MB

        • memory/4552-56-0x0000000076090000-0x0000000076643000-memory.dmp

          Filesize

          5.7MB

        • memory/4552-58-0x0000000074FD0000-0x0000000075044000-memory.dmp

          Filesize

          464KB

        • memory/4552-59-0x0000000074190000-0x00000000742B2000-memory.dmp

          Filesize

          1.1MB

        • memory/4552-57-0x0000000076B30000-0x0000000076BDF000-memory.dmp

          Filesize

          700KB

        • memory/4552-60-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-61-0x0000000075050000-0x0000000075260000-memory.dmp

          Filesize

          2.1MB

        • memory/4552-62-0x0000000076090000-0x0000000076643000-memory.dmp

          Filesize

          5.7MB

        • memory/4552-63-0x0000000076B30000-0x0000000076BDF000-memory.dmp

          Filesize

          700KB

        • memory/4552-64-0x00000000768E0000-0x0000000076905000-memory.dmp

          Filesize

          148KB

        • memory/4552-65-0x0000000074FD0000-0x0000000075044000-memory.dmp

          Filesize

          464KB

        • memory/4552-66-0x0000000074190000-0x00000000742B2000-memory.dmp

          Filesize

          1.1MB

        • memory/4552-67-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-68-0x0000000075050000-0x0000000075260000-memory.dmp

          Filesize

          2.1MB

        • memory/4552-69-0x0000000076090000-0x0000000076643000-memory.dmp

          Filesize

          5.7MB

        • memory/4552-70-0x0000000076B30000-0x0000000076BDF000-memory.dmp

          Filesize

          700KB

        • memory/4552-6-0x0000000002430000-0x0000000002431000-memory.dmp

          Filesize

          4KB

        • memory/4552-73-0x0000000074190000-0x00000000742B2000-memory.dmp

          Filesize

          1.1MB

        • memory/4552-74-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-71-0x0000000074FD0000-0x0000000075044000-memory.dmp

          Filesize

          464KB

        • memory/4552-75-0x0000000075B70000-0x0000000075C4C000-memory.dmp

          Filesize

          880KB

        • memory/4552-77-0x0000000075050000-0x0000000075260000-memory.dmp

          Filesize

          2.1MB

        • memory/4552-76-0x0000000075C50000-0x0000000075D33000-memory.dmp

          Filesize

          908KB

        • memory/4552-78-0x0000000076090000-0x0000000076643000-memory.dmp

          Filesize

          5.7MB

        • memory/4552-79-0x0000000076B30000-0x0000000076BDF000-memory.dmp

          Filesize

          700KB

        • memory/4552-80-0x0000000074FD0000-0x0000000075044000-memory.dmp

          Filesize

          464KB

        • memory/4552-81-0x0000000074190000-0x00000000742B2000-memory.dmp

          Filesize

          1.1MB

        • memory/4552-82-0x0000000003350000-0x00000000033B1000-memory.dmp

          Filesize

          388KB

        • memory/4552-162-0x0000000002430000-0x0000000002431000-memory.dmp

          Filesize

          4KB