23f4cf3bd27ada231b8e24cd453e2c795fa0618e858c0b696aaae5ec2fd78991

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4df913ce49b576b541c9f1491fa35578.exe
Size

3.5MB
MD5

4df913ce49b576b541c9f1491fa35578
SHA1

7e95d5a188bdc0f0cbbb9760540e51ae14071531
SHA256

23f4cf3bd27ada231b8e24cd453e2c795fa0618e858c0b696aaae5ec2fd78991
SHA512

9ef62d7b4cef8243af046f1f1d0a2167ef5b67b1d0a93f121227769bbf48991983674d9d9a715c1cdccb91655debf40b8ef227212daa69d4eaaf8ae889a40431
SSDEEP

49152:j+UF5eIfqkVn/Bja5TyHPuK4AK4WXpMtOEcC86TNo5RcfzxgBfokwUkR1lKU/MGO:HF8XOZjaIPT4NIOPC8gbflgwUu3ChQ4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2216	4df913ce49b576b541c9f1491fa35578.tmp

Loads dropped DLL 3 IoCs

pid	Process
3044	4df913ce49b576b541c9f1491fa35578.exe
2216	4df913ce49b576b541c9f1491fa35578.tmp
2216	4df913ce49b576b541c9f1491fa35578.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2216	4df913ce49b576b541c9f1491fa35578.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2216	3044	4df913ce49b576b541c9f1491fa35578.exe	28
PID 3044 wrote to memory of 2216	3044	4df913ce49b576b541c9f1491fa35578.exe	28
PID 3044 wrote to memory of 2216	3044	4df913ce49b576b541c9f1491fa35578.exe	28
PID 3044 wrote to memory of 2216	3044	4df913ce49b576b541c9f1491fa35578.exe	28
PID 3044 wrote to memory of 2216	3044	4df913ce49b576b541c9f1491fa35578.exe	28
PID 3044 wrote to memory of 2216	3044	4df913ce49b576b541c9f1491fa35578.exe	28
PID 3044 wrote to memory of 2216	3044	4df913ce49b576b541c9f1491fa35578.exe	28

C:\Users\Admin\AppData\Local\Temp\4df913ce49b576b541c9f1491fa35578.exe
"C:\Users\Admin\AppData\Local\Temp\4df913ce49b576b541c9f1491fa35578.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\is-L8ALK.tmp\4df913ce49b576b541c9f1491fa35578.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-L8ALK.tmp\4df913ce49b576b541c9f1491fa35578.tmp" /SL5="$400F4,3230774,140800,C:\Users\Admin\AppData\Local\Temp\4df913ce49b576b541c9f1491fa35578.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-L8ALK.tmp\4df913ce49b576b541c9f1491fa35578.tmp

Filesize
1.1MB

MD5
8fd32d871dfd28c4519cd9c96a120026

SHA1
5bd078aabbc46eb2a04de766dccbc82a6782aef9

SHA256
0c340a0c550cde8d73f7b109416faf9a1243c5bebcc5477123cb97028ba01088

SHA512
86a83f54723ba2d90109edf3f26739e4798b756ec7dd04e50a9cc3eb9075d9f213f1074057b01af55e3fe980a6fef2bea8bffefe0cb6e25b95f7ae42e0fa96e8

Download Submit
\Users\Admin\AppData\Local\Temp\is-L8ALK.tmp\4df913ce49b576b541c9f1491fa35578.tmp

Filesize
1024KB

MD5
4e28aef0d769232f38e6f008cfd3fb74

SHA1
7b0714d459f2f6a2ae4dd699ab59bb2aa089c1dc

SHA256
d3fc068272eed1feda3066e3f90c01d92928d53769250fa9e0be2289eb671371

SHA512
bcc3fec103250deda82dc2daba536270a21154379945c1c64f13a78963e3cc743901b98461827721724e1dd53dafd5fb7bdadc4b0c3298bb494ef269f28e0e36

Download Submit
\Users\Admin\AppData\Local\Temp\is-R7C22.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/2216-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2216-16-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2216-19-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3044-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3044-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads