4b5e2348f2c543409b3db559559d2415ddf8bfe3cdfb3327bd7fadedc491448c

Analysis

max time kernel
146s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3eea2036af99f64f8d82a4d142748a54.exe
Size

1.1MB
MD5

3eea2036af99f64f8d82a4d142748a54
SHA1

0768353747e2a4755ecc98c7ef1e291438fb7571
SHA256

4b5e2348f2c543409b3db559559d2415ddf8bfe3cdfb3327bd7fadedc491448c
SHA512

cf40537adb8c1e75e0a0f12896b2bc4efe9738cc9b12aac51f6f487e94b9f99d6274fafa6eac6dbfc8450346358d8ab3f82c6f6243254e6500085b2af6206c7b
SSDEEP

24576:5naiLqMBVrKArHaKLz0phtNtXkt+IPK3H+ZgGMSdkS3rJQBtUkBgJ:5aQLHrPLzkNtX4+IPK3H+SGMS9inXBgJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4644	3eea2036af99f64f8d82a4d142748a54.tmp

Loads dropped DLL 3 IoCs

pid	Process
4644	3eea2036af99f64f8d82a4d142748a54.tmp
4644	3eea2036af99f64f8d82a4d142748a54.tmp
4644	3eea2036af99f64f8d82a4d142748a54.tmp

Kills process with taskkill 1 IoCs

evasion

pid	Process
4144	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	taskkill.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4644	2816	3eea2036af99f64f8d82a4d142748a54.exe	90
PID 2816 wrote to memory of 4644	2816	3eea2036af99f64f8d82a4d142748a54.exe	90
PID 2816 wrote to memory of 4644	2816	3eea2036af99f64f8d82a4d142748a54.exe	90
PID 4644 wrote to memory of 1064	4644	3eea2036af99f64f8d82a4d142748a54.tmp	98
PID 4644 wrote to memory of 1064	4644	3eea2036af99f64f8d82a4d142748a54.tmp	98
PID 4644 wrote to memory of 1064	4644	3eea2036af99f64f8d82a4d142748a54.tmp	98
PID 1064 wrote to memory of 4144	1064	cmd.exe	101
PID 1064 wrote to memory of 4144	1064	cmd.exe	101
PID 1064 wrote to memory of 4144	1064	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\3eea2036af99f64f8d82a4d142748a54.exe
"C:\Users\Admin\AppData\Local\Temp\3eea2036af99f64f8d82a4d142748a54.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\is-FRVI1.tmp\3eea2036af99f64f8d82a4d142748a54.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FRVI1.tmp\3eea2036af99f64f8d82a4d142748a54.tmp" /SL5="$7021C,543473,54272,C:\Users\Admin\AppData\Local\Temp\3eea2036af99f64f8d82a4d142748a54.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c taskkill /f /im rkverify.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rkverify.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-5GU7N.tmp\Games.inf

Filesize
495B

MD5
cfdcc21186b8f14b100a94764e86af95

SHA1
d212b8cae6dcd3af59de766e7d0bbc913cef34ab

SHA256
26c3c6ddd5a1b18ed3556bf6d9db1c9f2cd00555b3ece1d02fb186c6a86adf78

SHA512
9254048fb2b8a8e065f6c073265f017dd9fc1dc21af60561b0767e28a8674917989ccbb2e027e198e0251dc0f08c2f28c2b279c5a255b8754cdbccc27d35884c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5GU7N.tmp\isxdl.dll

Filesize
49KB

MD5
02ecc74f7f91e9ffd84de708683236a6

SHA1
3532de0b77df8b0fc89e9c7eddec3fa71f98f5a2

SHA256
30ad8a0e1cee091ca48c771adb2e76baf1a7d54b9f60dc47f54dfdc2d6f6691e

SHA512
a3fdaa651f82428395bc412a2a04fce673768d3ef088b3748addf337d95464eb141ae7c286bff5c705eae05dd7b38207629588ae7e89ada15269463cd7acf541

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5GU7N.tmp\itdownload.dll

Filesize
92KB

MD5
34dacd43cdf7141683c1cb5d6422fa25

SHA1
dfbc423183962819f8a5f66bb3e8444573c9b879

SHA256
5269acad1b6dc0d9d53e1bf4837efd2c5d0d5ac703f049dc2530c8983b83240a

SHA512
9eeb9926067b0ebe4539c3bc7cbe84aa1c9877c71110c5ff545123329b650afb802aef803c05b075a773a9193f3493ae5fb64ff9d0e4cd7457607fdf2357c8f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5GU7N.tmp\itdownload.dll

Filesize
87KB

MD5
7ce1cf0dd8cb2c23bb224c83a8270310

SHA1
347c08fe15a568d2e777cab6f7535cc8fa80a69b

SHA256
c1819c18e9fb612b4f53061187b7849781746543e5d13ed15edda73dc65f4e72

SHA512
85ca4f0c4f5a6985dd2c6fc7acc284432d7fad0e323c095d0cab56857a786c4687be1ae11b0637973003997777212dc3e43a322fcd9e3547dbec31313bb2334d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FRVI1.tmp\3eea2036af99f64f8d82a4d142748a54.tmp

Filesize
688KB

MD5
c765336f0dcf4efdcc2101eed67cd30c

SHA1
fa0279f59738c5aa3b6b20106e109ccd77f895a7

SHA256
c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

SHA512
06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

Download Submit
memory/2816-33-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2816-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2816-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2816-43-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4644-17-0x00000000032A0000-0x00000000032DC000-memory.dmp

Filesize
240KB

Download
memory/4644-7-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4644-34-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4644-35-0x00000000032A0000-0x00000000032DC000-memory.dmp

Filesize
240KB

Download
memory/4644-42-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download