Analysis

  • max time kernel
    141s
  • max time network
    43s
  • platform
    windows10-1703_x64
  • resource
    win10-20231129-en
  • resource tags

    arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11/12/2023, 14:52 UTC

General

  • Target

    7d4ddf59904d1f955f29565a8611b579990cc265167a11228f805348c7b2b693.exe

  • Size

    6.9MB

  • MD5

    ebd88728f53deab90d34ec7d825e8d37

  • SHA1

    28ea94090bf1016298252cc19f3477af257942cf

  • SHA256

    7d4ddf59904d1f955f29565a8611b579990cc265167a11228f805348c7b2b693

  • SHA512

    6792e7161303bd9c0b988fb9921b31124f4e1059ebb1242eabfd8fd9381127d4136b203baa304b85026f0fa2ac2ada1e8c6cf02ffbe8ecb497b536e9a057f505

  • SSDEEP

    196608:lxOlhkHxfDumIwWJfU1IzKkGjAqiuGIqOg9zj:2jkHxfKTnJjzKkRtF9zj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d4ddf59904d1f955f29565a8611b579990cc265167a11228f805348c7b2b693.exe
    "C:\Users\Admin\AppData\Local\Temp\7d4ddf59904d1f955f29565a8611b579990cc265167a11228f805348c7b2b693.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Users\Admin\AppData\Local\Temp\is-E50KP.tmp\7d4ddf59904d1f955f29565a8611b579990cc265167a11228f805348c7b2b693.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-E50KP.tmp\7d4ddf59904d1f955f29565a8611b579990cc265167a11228f805348c7b2b693.tmp" /SL5="$501FA,6950053,68096,C:\Users\Admin\AppData\Local\Temp\7d4ddf59904d1f955f29565a8611b579990cc265167a11228f805348c7b2b693.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      PID:4624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-E50KP.tmp\7d4ddf59904d1f955f29565a8611b579990cc265167a11228f805348c7b2b693.tmp

    Filesize

    687KB

    MD5

    f448d7f4b76e5c9c3a4eaff16a8b9b73

    SHA1

    31808f1ffa84c954376975b7cdb0007e6b762488

    SHA256

    7233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49

    SHA512

    f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4

  • \Users\Admin\AppData\Local\Temp\is-RJGO6.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • \Users\Admin\AppData\Local\Temp\is-RJGO6.tmp\_isetup\_isdecmp.dll

    Filesize

    19KB

    MD5

    3adaa386b671c2df3bae5b39dc093008

    SHA1

    067cf95fbdb922d81db58432c46930f86d23dded

    SHA256

    71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

    SHA512

    bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

  • memory/4260-0-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/4260-32-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/4624-11-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

  • memory/4624-33-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/4624-36-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.