f5cd8916bb175a6eda556757ff61fc1dbaaae4bea5956dece0301e36209c134f

Analysis

max time kernel
142s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ddad5537e998ca95148213f44f33b01.exe
Size

1.9MB
MD5

0ddad5537e998ca95148213f44f33b01
SHA1

74a10242f1d73446c4a8b837db00785837b2c0d0
SHA256

f5cd8916bb175a6eda556757ff61fc1dbaaae4bea5956dece0301e36209c134f
SHA512

70d408d5d83d769c1469cc57ccc7a3ecb9a4475fe5d15834c1ee9ffcfaa20ed9fbbdd7292293e3a7796bb551ad19bc56203b93ba0f292763fc0c8eb7c9d69743
SSDEEP

49152:5abRL+SFAxoF/EUYI8BxR+8Skix0kinXBgJ:QbZ+QAxoFMhIgElkOKRgJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1632	0ddad5537e998ca95148213f44f33b01.tmp

Loads dropped DLL 4 IoCs

pid	Process
1996	0ddad5537e998ca95148213f44f33b01.exe
1632	0ddad5537e998ca95148213f44f33b01.tmp
1632	0ddad5537e998ca95148213f44f33b01.tmp
1632	0ddad5537e998ca95148213f44f33b01.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1632	0ddad5537e998ca95148213f44f33b01.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1632	1996	0ddad5537e998ca95148213f44f33b01.exe	28
PID 1996 wrote to memory of 1632	1996	0ddad5537e998ca95148213f44f33b01.exe	28
PID 1996 wrote to memory of 1632	1996	0ddad5537e998ca95148213f44f33b01.exe	28
PID 1996 wrote to memory of 1632	1996	0ddad5537e998ca95148213f44f33b01.exe	28
PID 1996 wrote to memory of 1632	1996	0ddad5537e998ca95148213f44f33b01.exe	28
PID 1996 wrote to memory of 1632	1996	0ddad5537e998ca95148213f44f33b01.exe	28
PID 1996 wrote to memory of 1632	1996	0ddad5537e998ca95148213f44f33b01.exe	28

C:\Users\Admin\AppData\Local\Temp\0ddad5537e998ca95148213f44f33b01.exe
"C:\Users\Admin\AppData\Local\Temp\0ddad5537e998ca95148213f44f33b01.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\is-9EFCN.tmp\0ddad5537e998ca95148213f44f33b01.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9EFCN.tmp\0ddad5537e998ca95148213f44f33b01.tmp" /SL5="$A0154,1549099,54272,C:\Users\Admin\AppData\Local\Temp\0ddad5537e998ca95148213f44f33b01.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-637JT.tmp\Games.inf

Filesize
211B

MD5
1707809c08da96680afad42f397e258f

SHA1
9969c92d13a488059842fe8fc07c51429b332da4

SHA256
c4e1a800473961127a511922da63b2bf7a6074bc1c91bdc95f20655487af853f

SHA512
b0268ff73df69874da84fec70217a53316ea1bf9dacf6a0e8334fd7001861af8430d2012b7dfc06a96300fa7c9e536fc99e38a49ae46329d013c025bc2e700e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9EFCN.tmp\0ddad5537e998ca95148213f44f33b01.tmp

Filesize
307KB

MD5
e70c6eee862ea3106bf34b62ce7f7620

SHA1
52a2afea22c386918aea38ffc19257d474bb9735

SHA256
06732419b094d246951438a558e50cfb13d65a775b916a7eeed008ec866e65c6

SHA512
4e5d587c8c1ebeb51a91f77164eb01031cdf5c8be47e928a555ef078f649dff20cde050389fa28711917fcdffd4cc3678e446e7e33bcab8be8c4a3f77b45179e

Download Submit
\Users\Admin\AppData\Local\Temp\is-637JT.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-637JT.tmp\isxdl.dll

Filesize
49KB

MD5
02ecc74f7f91e9ffd84de708683236a6

SHA1
3532de0b77df8b0fc89e9c7eddec3fa71f98f5a2

SHA256
30ad8a0e1cee091ca48c771adb2e76baf1a7d54b9f60dc47f54dfdc2d6f6691e

SHA512
a3fdaa651f82428395bc412a2a04fce673768d3ef088b3748addf337d95464eb141ae7c286bff5c705eae05dd7b38207629588ae7e89ada15269463cd7acf541

Download Submit
\Users\Admin\AppData\Local\Temp\is-9EFCN.tmp\0ddad5537e998ca95148213f44f33b01.tmp

Filesize
360KB

MD5
ffede1c770038c45fcaa0876bcc479c2

SHA1
e9fd982b105183479d0616a7cd7010f6ff633361

SHA256
9eac194470f352ec5423d52d332943c293a9cb951fd8859ac91eb5e39ef0223e

SHA512
d68b19a83d23c4d1e885cb1ca795d40223f050bfb5a1335f07d47522c9fb61cb3b25fb4515d107c02e04d0f75135192db8d79d96e456e2237a0f345415389388

Download Submit
memory/1632-24-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1632-18-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1632-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1632-25-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1632-42-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1996-17-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1996-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1996-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads