Analysis
-
max time kernel
172s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 02:35
Behavioral task
behavioral1
Sample
004851a7934fadc20101cf3728ee2577.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
004851a7934fadc20101cf3728ee2577.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
004851a7934fadc20101cf3728ee2577.exe
-
Size
1.8MB
-
MD5
004851a7934fadc20101cf3728ee2577
-
SHA1
e71daae385b9f02e2abec38e8c1e760b9422ba4d
-
SHA256
42c4eda0de316b2ebe0906674e5de5ff7de3e0fb74cea721e8c30b9e206fc314
-
SHA512
197eee9729be0a8c63f651c1daf83a3322716575b42d99cbc63a3adfe13b504d490d9ef5c5d0c67e65a3d2dce83e9e3206ca414867c351dd90880a8ff6880762
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqH:SCqm2Jpr0nNM7Dus7NxW
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3876-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0002000000022794-5.dat upx behavioral2/memory/3876-111-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\Lang\id.txt.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.exe 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\Lang\lij.txt.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\Lang\az.txt.exe 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\ado\msadox.dll 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.exe 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.exe 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\Lang\tt.txt.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\Lang\ba.txt.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\Lang\hi.txt.exe 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\Lang\mk.txt.exe 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.exe 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.exe 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 004851a7934fadc20101cf3728ee2577.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\Services\verisign.bmp.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\7zCon.sfx.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\Lang\en.ttt.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\Lang\ru.txt.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\Lang\gu.txt.exe 004851a7934fadc20101cf3728ee2577.exe File created C:\Program Files\7-Zip\Lang\mng.txt.exe 004851a7934fadc20101cf3728ee2577.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD51b12cebe3e6ed3490d1494e9ccde93ea
SHA1edaa53a0ef055be2d27da7576c0cc9427c731306
SHA256e0696348ea8fac2cbb4b13c2d53a81cc9df9b7fb9048ed44ee9ca1416006cea0
SHA5120052a06e28113bd5f071d38a61df2e28b34dfa9386225deb40526f143cec416712247981b83c4332e1f7321c68729edfc2aae47ba380dd9c3be30ab821449dd4