f730a3cfb5381f8d00dfedfd5443274512a46511006743159c92563fadddac8c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26a8eb35ac1417b9df17d692bf054f0b.exe
Size

209KB
MD5

26a8eb35ac1417b9df17d692bf054f0b
SHA1

799ef234ecc29c88595b3b973e063e3a69317a6f
SHA256

f730a3cfb5381f8d00dfedfd5443274512a46511006743159c92563fadddac8c
SHA512

339f5a7e173dc8da3eabfa0dc186c49ddd1b95381dec902d37b5de09a2064b96a9c1947281afb4ac6aa919774288adab44bc3e8e62527e116e7b97a125890ceb
SSDEEP

6144:8lNgws6Fchn400fz94pVaFf972DOLJX0vv45:8hs6Sh4B4KF726L9ev

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
844	u.dll
1676	mpress.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4308	OpenWith.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 5008	3832	26a8eb35ac1417b9df17d692bf054f0b.exe	96
PID 3832 wrote to memory of 5008	3832	26a8eb35ac1417b9df17d692bf054f0b.exe	96
PID 3832 wrote to memory of 5008	3832	26a8eb35ac1417b9df17d692bf054f0b.exe	96
PID 5008 wrote to memory of 844	5008	cmd.exe	89
PID 5008 wrote to memory of 844	5008	cmd.exe	89
PID 5008 wrote to memory of 844	5008	cmd.exe	89
PID 844 wrote to memory of 1676	844	u.dll	93
PID 844 wrote to memory of 1676	844	u.dll	93
PID 844 wrote to memory of 1676	844	u.dll	93
PID 5008 wrote to memory of 1924	5008	cmd.exe	92
PID 5008 wrote to memory of 1924	5008	cmd.exe	92
PID 5008 wrote to memory of 1924	5008	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\26a8eb35ac1417b9df17d692bf054f0b.exe
"C:\Users\Admin\AppData\Local\Temp\26a8eb35ac1417b9df17d692bf054f0b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\49BB.tmp\vir.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5008

C:\Users\Admin\AppData\Local\Temp\u.dll
u.dll -bat vir.bat -save 26a8eb35ac1417b9df17d692bf054f0b.exe.com -include s.dll -overwrite -nodelete
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\AppData\Local\Temp\4A19.tmp\mpress.exe
  "C:\Users\Admin\AppData\Local\Temp\4A19.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe4A1A.tmp"
  2⤵
  - Executes dropped EXE
  PID:1676

C:\Windows\SysWOW64\calc.exe
CALC.EXE
1⤵
- Modifies registry class
PID:1924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\49BB.tmp\vir.bat

Filesize
1KB

MD5
468426ee889925f13ffc2f79863b827d

SHA1
b88acd322486eef3e9199f9c287d3f93253c29a2

SHA256
ea25766c36525bed15362b281484d633897585fa9deb07c85afd73b79e1add56

SHA512
4313e2c7137c4140b9a0278be939edf14fc7d142401a53457e5f5428c652f3da9a6879fde902bebe741c3f5f809bac7be30dbbf1e7ad8c19da095abbb6e54d7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\4A19.tmp\mpress.exe

Filesize
100KB

MD5
e42b81b9636152c78ba480c1c47d3c7f

SHA1
66a2fca3925428ee91ad9df5b76b90b34d28e0f8

SHA256
7c24c72439880e502be51da5d991b9b56a1af242b4eef4737f0f43b4a87546d2

SHA512
4b2986106325c5c3fe11ab460f646d4740eb85252aa191f2b84e29901fac146d7a82e31c72d39c38a70277f78278621ee506d9da2681f5019cd64c7df85cff6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\exe4A1A.tmp

Filesize
41KB

MD5
cfb6c23b4ec82cb8a0c562d2b9f34c23

SHA1
c7b496195abf2cceb09d8536768d83ab4aed6687

SHA256
28feed5f31044cbc96b185cd8ac0b12cffbc848b895ffce7d4005e25f7a8faff

SHA512
55a2e71b87db5af46c90eab14f95534d0deed807e91c4a52fb762141972a051633decedaf41b19b857efe8fd24821b59e15b33c9e00073da094495ea316420ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpr4AF3.tmp

Filesize
24KB

MD5
1c591a621b30fb31de8b83694bffdb57

SHA1
94b0acf10c424c4990f88d8d63ba0ef31231fde8

SHA256
71a4439b7c9ba5b21532c4e3c05f39fd19f2ad9e8f1e7da85244339f7fac0e3d

SHA512
4921aee10a3d419ebbfad7f9f877177fce6aad5a1084099046f97ee63d577d9f54d42b6de5ca256f5250264f929988fbd8e4e050996673c99d95dae8833abe2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\u.dll

Filesize
700KB

MD5
0ba8f8311fc3afbb7e32d98236f2efa6

SHA1
956dd3548df11f2c6c36366d74109ddddc33fc33

SHA256
5b6da37dd4f1fa6402e7ee652ef048f7bd7b396f7a3b3f61c56865d5cd3f6e62

SHA512
706f455d004af6d1442402c1a750a37da14da0351c51d0b0b578349355956986941c4a302956590be7c2b00caa6838e3b265dab8766e8636e0c6c4527b82c4e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir.bat

Filesize
1KB

MD5
69332f03fce13f80403f3615e914112b

SHA1
0e2175ba923ca3ab973f40713ece1e92650bb16c

SHA256
93f82cb92dbd9c339f1e12c3496d663ba99cd4ac66d82c67b51c5fd75a901dd1

SHA512
98dbbd0689a0fa812de368400979897346e23b58dec2677301de5627441955bb37e917e8a9fe81cbf00a4264dece5330e477bf5bf33b15cc072c33dee07fb6bd

Download Submit
memory/1676-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1676-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3832-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/3832-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/3832-71-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads