10a1c7b35ca72b41f0b79fc41fee352e35cf22e3d2e38179a419b1c5cf395743

Analysis

max time kernel
159s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45500051537bb0727da8f7f9a9b6c28a.exe
Size 209KB
Sample231226-afk9qsdcg3
SHA256 10a1c7b35ca72b41f0b79fc41fee352e35cf22e3d2e38179a419b1c5cf395743
MD5 45500051537bb0727da8f7f9a9b6c28a
SHA1 eb4e2f17d27743adf74da650cc47978bbe423f37
SHA512 f033951af39d76451386f27ebc80c898548211d394f5d95316f3a9ddbb4b246e7aa10c6baccf01fd5bfe013d93d125216ff5856003fe55f2299a3cd673cf82f6
SSDEEP 6144:xld+eLHjeZFiiINS0OoXcIGJhlLdGS0W0UwX:R+aH4FiiIDOAFGJh50W0Um
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3448	u.dll
4160	mpress.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4376	OpenWith.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 3076	3492	45500051537bb0727da8f7f9a9b6c28a.exe	93
PID 3492 wrote to memory of 3076	3492	45500051537bb0727da8f7f9a9b6c28a.exe	93
PID 3492 wrote to memory of 3076	3492	45500051537bb0727da8f7f9a9b6c28a.exe	93
PID 3076 wrote to memory of 3448	3076	cmd.exe	95
PID 3076 wrote to memory of 3448	3076	cmd.exe	95
PID 3076 wrote to memory of 3448	3076	cmd.exe	95
PID 3448 wrote to memory of 4160	3448	u.dll	100
PID 3448 wrote to memory of 4160	3448	u.dll	100
PID 3448 wrote to memory of 4160	3448	u.dll	100
PID 3076 wrote to memory of 4820	3076	cmd.exe	101
PID 3076 wrote to memory of 4820	3076	cmd.exe	101
PID 3076 wrote to memory of 4820	3076	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\45500051537bb0727da8f7f9a9b6c28a.exe
"C:\Users\Admin\AppData\Local\Temp\45500051537bb0727da8f7f9a9b6c28a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2B12.tmp\vir.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\AppData\Local\Temp\u.dll
    u.dll -bat vir.bat -save 45500051537bb0727da8f7f9a9b6c28a.exe.com -include s.dll -overwrite -nodelete
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\5678.tmp\mpress.exe
      "C:\Users\Admin\AppData\Local\Temp\5678.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe5679.tmp"
      4⤵
      Executes dropped EXE
      PID:4160
- - C:\Windows\SysWOW64\calc.exe
    CALC.EXE
    3⤵
    - Modifies registry class
    PID:4820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

vir.bat

Path C:\Users\Admin\AppData\Local\Temp\2B12.tmp\vir.bat
Size 1KB
SHA256 c5a3d68609efad15d1e56988c5b3847ad163129f318b8bb1ddf06c24b3ee50ea
MD5 a3d0d40c3144a11c5014a91d27295a2f
SHA1 62b47892e73a710c3e6b23ab01d2ac46c6561d13
SHA512 746037484aedd40d5dbda91baae6676ecd1bd670cc7568327bdd9f97580303d434a5d2c947f39f00c6d513048d8adb9ebd9747a54573aba562fdd38e8b77e28a
MD5 SHA1 SHA512

Submit Download

mpress.exe

Path C:\Users\Admin\AppData\Local\Temp\5678.tmp\mpress.exe
Size 100KB
SHA256 7c24c72439880e502be51da5d991b9b56a1af242b4eef4737f0f43b4a87546d2
MD5 e42b81b9636152c78ba480c1c47d3c7f
SHA1 66a2fca3925428ee91ad9df5b76b90b34d28e0f8
SHA512 4b2986106325c5c3fe11ab460f646d4740eb85252aa191f2b84e29901fac146d7a82e31c72d39c38a70277f78278621ee506d9da2681f5019cd64c7df85cff6e
SSDEEP 1536:k0d2QHvIezyfLHUvtLgFki03GxdhxF+gINFa9E9xYpfCJ2P7PomYGAj0kAYamzn:kG2QPGjIg02rF+PRj6fCuAmYGGZL
MD5 SHA1 SHA512 SSDEEP

Submit Download

exe5679.tmp

Path C:\Users\Admin\AppData\Local\Temp\exe5679.tmp
Size 41KB
SHA256 d47a5a1f144a7b1a0267ec604f18238419a29402b4ef51f1b2165f346ef88951
MD5 2962dfcac22070e3da981e1115397938
SHA1 09a2ddd77cc9265c1c9a3a0b3797ea5007e3bd28
SHA512 8efe28ee9ba694a2cc010bb61736de3f7bc190c3656f814a700e9992391a174982fa21f16d24ce1c36876e095f1a76569183cee52048ae22102cac621beb422a
SSDEEP 768:hHlAgq30fNHGG0veMq1sBCpouTDdwIBljrkieu3jD3o+//ypBFds:hH6LeMq1hj5Qir3jU+Qds
MD5 SHA1 SHA512 SSDEEP

Submit Download

mpr9AD4.tmp

Path C:\Users\Admin\AppData\Local\Temp\mpr9AD4.tmp
Size 24KB
SHA256 e6f5642d95d82404f0c87ce3b455c662ad247d533cc01b0f454d194b244207c4
MD5 b799e4b3cff5cefeb8355cff4153f617
SHA1 cf39041f0b03033f148329b62c2f593ffb3ce8cc
SHA512 62e28c9cf91fd311d2dee021062a92eacf482455842a6f835afedfb368d84de089569ae032a37c85c05c4cc20d1e1aeeda2cda6e673fa42e00b80b19974b9f63
SSDEEP 768:eHHKmM0qaued7Adjnuj5gLi1DjQapjb5iwv70mM7Dyds:eKmMyx8iFgLi13ZP5iwvvdds
MD5 SHA1 SHA512 SSDEEP

Submit Download

s.dll

Path C:\Users\Admin\AppData\Local\Temp\s.dll
Size 700KB
SHA256 8b16836b18106d0e8fdbb4b26beefee04479fe219a59cc2a186b68db91fcd832
MD5 03e84bf7ea2eba6e881e868ceefe2526
SHA1 09019ed20cf16847a264f5d1840ee0802f1778a6
SHA512 32a47a7b4725f2d71573ad855b0a3bc99b3fa86d70f7b1b60456361bbcd03d37ea58f2b7092c0b6993e156db4ddd66b1d544363523f580a6dd8c055697ec2026
SSDEEP 12288:JSpDS5cTfsrtPdOy4nVY5/pBdNQxIMLiVhwFAYxWR4I:JSY5cHY5Po1iVmFZRI
MD5 SHA1 SHA512 SSDEEP

Submit Download

vir.bat

Path C:\Users\Admin\AppData\Local\Temp\vir.bat
Size 2KB
SHA256 d332402506ae7ca8bd9908ffd17450cc0eee5faeb36978352dfbf6253ad5892d
MD5 76767e0fce74320ed5377b27416afa0d
SHA1 d8d450f54e3927e124cc9646eab41359463e3bf5
SHA512 360a3a9488dcaac0116584a9f4055160dd3ee779c2ddb31715b3fec7ba39019e9fc46196a0ef160181f5f9528cc08e2048cb33b68def8dc5b916dd7fef0109a1
MD5 SHA1 SHA512

Submit Download

memory/3492-7-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3492-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3492-18-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3492-3-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3492-2-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3492-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4160-60-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4160-68-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads