82559d919db6f971aeb19316d86dda8bb735f7a4830f5a62fb70d521ff0f15b2

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-12-2023 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

installer.exe
Size

41KB
MD5

19668f1460eccde1dc875e69ec6325b7
SHA1

596d7a55839d578a2dfdef3d04023ed66bfff03e
SHA256

82559d919db6f971aeb19316d86dda8bb735f7a4830f5a62fb70d521ff0f15b2
SHA512

47e45dde0085a5d82eb264b964ba4dc628fab87e40f67bc9f6bf799de3a7fa1cb50c910b6cad97ebad9bced35e97964ed88516f7d4c7174287daafc528dc22fc
SSDEEP

768:Ga7HmiY7iDT6pKf6QSiWhkU57lLOv2a0KKR5sFbAgAbLcGukYH5X:+iY0TyKdWhkU57lLOd0K+5sF8gAbLMki

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2988	installer.exe

Loads dropped DLL 1 IoCs

pid	Process
2236	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2760	schtasks.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2988	2236	installer.exe	28
PID 2236 wrote to memory of 2988	2236	installer.exe	28
PID 2236 wrote to memory of 2988	2236	installer.exe	28
PID 2236 wrote to memory of 2988	2236	installer.exe	28
PID 2236 wrote to memory of 2988	2236	installer.exe	28
PID 2236 wrote to memory of 2988	2236	installer.exe	28
PID 2236 wrote to memory of 2988	2236	installer.exe	28
PID 2988 wrote to memory of 2760	2988	installer.exe	29
PID 2988 wrote to memory of 2760	2988	installer.exe	29
PID 2988 wrote to memory of 2760	2988	installer.exe	29
PID 2988 wrote to memory of 2760	2988	installer.exe	29

C:\Users\Admin\AppData\Local\Temp\installer.exe
"C:\Users\Admin\AppData\Local\Temp\installer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\XenoManager\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\XenoManager\installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "hdrealtek" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9859.tmp" /F
    3⤵
    - Creates scheduled task(s)
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9859.tmp

Filesize
1KB

MD5
b2ac3c7ce2ed43c81a5224181b86ca39

SHA1
0044ecc350c384b18c7bfd158c8ef556ae9fe87b

SHA256
bb017fa7570d2a677bef7575c094c548e551329d9fc05870f275d2061fbee658

SHA512
29e53e38b0e767f18f024119eb0c9cee3a85feb326cf5b32ac7417828f767755db7ad5fe375bf9dc58a8327657ae6a45c67b2721e26c410b5e55e7456336988c

Download Submit
\Users\Admin\AppData\Local\Temp\XenoManager\installer.exe

Filesize
41KB

MD5
19668f1460eccde1dc875e69ec6325b7

SHA1
596d7a55839d578a2dfdef3d04023ed66bfff03e

SHA256
82559d919db6f971aeb19316d86dda8bb735f7a4830f5a62fb70d521ff0f15b2

SHA512
47e45dde0085a5d82eb264b964ba4dc628fab87e40f67bc9f6bf799de3a7fa1cb50c910b6cad97ebad9bced35e97964ed88516f7d4c7174287daafc528dc22fc

Download Submit
memory/2236-0-0x0000000000C50000-0x0000000000C60000-memory.dmp

Filesize
64KB

Download
memory/2236-1-0x0000000073FE0000-0x00000000746CE000-memory.dmp

Filesize
6.9MB

Download
memory/2236-14-0x0000000073FE0000-0x00000000746CE000-memory.dmp

Filesize
6.9MB

Download
memory/2988-9-0x00000000008A0000-0x00000000008B0000-memory.dmp

Filesize
64KB

Download
memory/2988-10-0x0000000073FE0000-0x00000000746CE000-memory.dmp

Filesize
6.9MB

Download
memory/2988-13-0x0000000004A40000-0x0000000004A80000-memory.dmp

Filesize
256KB

Download
memory/2988-15-0x0000000073FE0000-0x00000000746CE000-memory.dmp

Filesize
6.9MB

Download
memory/2988-16-0x0000000004A40000-0x0000000004A80000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads