Analysis
-
max time kernel
7s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 06:36
Behavioral task
behavioral1
Sample
2be664630cfc8f87d722faf279ac1408.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2be664630cfc8f87d722faf279ac1408.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2be664630cfc8f87d722faf279ac1408.exe
-
Size
1.8MB
-
MD5
2be664630cfc8f87d722faf279ac1408
-
SHA1
d9f897cf5e767627b5a06ef369d3c4cbec1b20a6
-
SHA256
d2c02f060d34ba80bceb0960e316aea7b5a7ff8bb99d24f9128e2d2ba5eaf077
-
SHA512
873ad3b957d0b10ec6f3af8717dfea905e2ad4ac302888d0649617dc37c1b81b0ee708ec6bdbcc2b0adb492d03523529944c0508ddc9e23ff0f4b73d935f6ec9
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxq+:SCqm2Jpr0nNM7Dus7Nxj
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4348-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/memory/4348-3107-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\7-Zip\License.txt 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.exe 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.exe 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.exe 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.exe 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\7-Zip\descript.ion.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\7-Zip\Uninstall.exe.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\7-Zip\Lang\mr.txt.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.exe 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\7-Zip\Lang\ko.txt.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\7-Zip\Lang\ru.txt.exe 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.exe 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\7-Zip\Lang\fa.txt.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.exe 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.exe 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2be664630cfc8f87d722faf279ac1408.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui 2be664630cfc8f87d722faf279ac1408.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 2be664630cfc8f87d722faf279ac1408.exe