6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944

General

Target

6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.exe
Size

7.8MB
MD5

5e32f65001837d6cccda4353781a96c6
SHA1

a4adc27ee7c1b7fc66a6d9a3f83cc0bd01a1ecf8
SHA256

6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944
SHA512

af295aee09e7defc8ac3a28dc2c4686db82fa11071eb60f5795c7e9f7d09b898e585bd3b94b1fcc9e3d96afe21b37d78ec270d762a4710e85d80a2019d3d86b8
SSDEEP

196608:rTgbRGSHLDj2kjBRbd3+TnH5D4vltlCIBeiQf6e4mhVd:YbRG8LP2WlsZD4vloLf6e4EH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmpbassmix.exebassmix.exe

pid process

3752 6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
2764 bassmix.exe
3456 bassmix.exe

Loads dropped DLL 3 IoCs

Processes:

6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp

pid	process
3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 152.89.198.214
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc
Destination IP	152.89.198.214

Drops file in Program Files directory 63 IoCs

Processes:

6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp

description	ioc	process
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-K0G6I.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-2E798.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-EJF1L.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-OK16A.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-TTIGE.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-5VAO7.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-D9IRV.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-0BK7N.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-T9MQQ.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-SU677.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-GRFIG.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-E353Q.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File opened for modification	C:\Program Files (x86)\BassMixerLib\install\unins000.dat	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\stuff\is-F614K.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-TSBAV.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-CIA35.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-CJOR0.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-6J4TS.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-SC9FP.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-OLIOR.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\stuff\is-ABSGA.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-5OVBV.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\is-E0N59.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-PKFRD.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-2Q1B2.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-4NF33.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-BHNIH.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-UA3MT.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\stuff\is-GLASC.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-D4MBD.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\lessmsi\is-GIS8K.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-Q8T8U.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-R4K37.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-KRTO7.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\plugins\internal\is-R2S5A.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-JG7KD.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-FKTJJ.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-MCD7L.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-U22DV.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-A52D1.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-71KRL.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\install\unins000.dat	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-CJ15M.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-0L853.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-CBHDD.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-NEVBI.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-KUDL9.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-1A7R2.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-502U5.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-GSJSP.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File opened for modification	C:\Program Files (x86)\BassMixerLib\bassmix.exe	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-BHAG2.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-1U9KP.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-BQ5E5.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\plugins\internal\is-DEPUE.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-7BVFG.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-KJBJD.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-FU0NN.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-M25DF.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\install\is-B2KRV.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\stuff\is-EGKLH.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-3FBKB.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
File created	C:\Program Files (x86)\BassMixerLib\bin\x86\is-85L95.tmp	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp

Runs net.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.exe6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmpnet.exe

description	pid	process	target process
PID 1252 wrote to memory of 3752	1252	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.exe	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
PID 1252 wrote to memory of 3752	1252	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.exe	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
PID 1252 wrote to memory of 3752	1252	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.exe	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
PID 3752 wrote to memory of 928	3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp	schtasks.exe
PID 3752 wrote to memory of 928	3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp	schtasks.exe
PID 3752 wrote to memory of 928	3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp	schtasks.exe
PID 3752 wrote to memory of 2764	3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp	bassmix.exe
PID 3752 wrote to memory of 2764	3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp	bassmix.exe
PID 3752 wrote to memory of 2764	3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp	bassmix.exe
PID 3752 wrote to memory of 3844	3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp	net.exe
PID 3752 wrote to memory of 3844	3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp	net.exe
PID 3752 wrote to memory of 3844	3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp	net.exe
PID 3752 wrote to memory of 3456	3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp	bassmix.exe
PID 3752 wrote to memory of 3456	3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp	bassmix.exe
PID 3752 wrote to memory of 3456	3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp	bassmix.exe
PID 3844 wrote to memory of 2096	3844	net.exe	net1.exe
PID 3844 wrote to memory of 2096	3844	net.exe	net1.exe
PID 3844 wrote to memory of 2096	3844	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.exe
"C:\Users\Admin\AppData\Local\Temp\6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252

C:\Users\Admin\AppData\Local\Temp\is-FK67F.tmp\6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
"C:\Users\Admin\AppData\Local\Temp\is-FK67F.tmp\6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp" /SL5="$7022E,7945557,54272,C:\Users\Admin\AppData\Local\Temp\6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3752

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Query
3⤵
PID:928

C:\Program Files (x86)\BassMixerLib\bassmix.exe
"C:\Program Files (x86)\BassMixerLib\bassmix.exe" -i
3⤵
- Executes dropped EXE
PID:2764

C:\Program Files (x86)\BassMixerLib\bassmix.exe
"C:\Program Files (x86)\BassMixerLib\bassmix.exe" -s
3⤵
- Executes dropped EXE
PID:3456

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 7
3⤵
- Suspicious use of WriteProcessMemory
PID:3844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 7
4⤵
PID:2096

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BassMixerLib\bassmix.exe
Filesize
3.6MB

MD5
d19f25c705d64721ac18a53f8a5d5d12

SHA1
9992344a9cd183e2d7a02f3464a05d994877866d

SHA256
1d63bc61bf361dae8e34902845aee92de7124aa6980b4ebe36dc5cbf643f61c4

SHA512
493c43cab428006195d40c072b79d7b3df640b2c3ddf675464755c7c9d74a5bd94d27c290abd0479bcfe4cf98100464b61e640e3faf4bf4661003fcf8edd00fd

Download Submit
C:\Program Files (x86)\BassMixerLib\bassmix.exe
Filesize
3.6MB

MD5
d19f25c705d64721ac18a53f8a5d5d12

SHA1
9992344a9cd183e2d7a02f3464a05d994877866d

SHA256
1d63bc61bf361dae8e34902845aee92de7124aa6980b4ebe36dc5cbf643f61c4

SHA512
493c43cab428006195d40c072b79d7b3df640b2c3ddf675464755c7c9d74a5bd94d27c290abd0479bcfe4cf98100464b61e640e3faf4bf4661003fcf8edd00fd

Download Submit
C:\Program Files (x86)\BassMixerLib\bassmix.exe
Filesize
3.6MB

MD5
d19f25c705d64721ac18a53f8a5d5d12

SHA1
9992344a9cd183e2d7a02f3464a05d994877866d

SHA256
1d63bc61bf361dae8e34902845aee92de7124aa6980b4ebe36dc5cbf643f61c4

SHA512
493c43cab428006195d40c072b79d7b3df640b2c3ddf675464755c7c9d74a5bd94d27c290abd0479bcfe4cf98100464b61e640e3faf4bf4661003fcf8edd00fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FK67F.tmp\6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
Filesize
694KB

MD5
5525670a9e72d77b368a9aa4b8c814c1

SHA1
3fdad952ea00175f3a6e549b5dca4f568e394612

SHA256
1180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978

SHA512
757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FK67F.tmp\6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
Filesize
694KB

MD5
5525670a9e72d77b368a9aa4b8c814c1

SHA1
3fdad952ea00175f3a6e549b5dca4f568e394612

SHA256
1180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978

SHA512
757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O871N.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O871N.tmp\_isetup\_isdecmp.dll
Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O871N.tmp\_isetup\_isdecmp.dll
Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
memory/1252-160-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1252-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1252-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2764-150-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/2764-151-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/2764-155-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/2764-154-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-180-0x00000000009E0000-0x0000000000A82000-memory.dmp

Filesize
648KB

Download
memory/3456-179-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-157-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-208-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-162-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-205-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-166-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-167-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-170-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-173-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-176-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-159-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-202-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-185-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-188-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-189-0x00000000009E0000-0x0000000000A82000-memory.dmp

Filesize
648KB

Download
memory/3456-192-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-195-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3456-198-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/3752-7-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/3752-163-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/3752-161-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download

pid	process
3752	6916c24f82fac9c8e199185b575757c919f5eec8e222667cd91f6057c1372944.tmp
2764	bassmix.exe
3456	bassmix.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads