61b74757886c050cffb49d1fb087be299ead442fd0407b2b5b8c91225072d22e

Analysis

max time kernel
156s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4kvideodownloaderplus_1.3.0_x64_online.exe
Size

942KB
MD5

8ae74fe676cf429de0233dea70a93634
SHA1

97217d4ec84fc325598481182d4ffbb6aab49d4b
SHA256

61b74757886c050cffb49d1fb087be299ead442fd0407b2b5b8c91225072d22e
SHA512

549c29bb157d44932fcff479445740953de6ce490e8053b3ebef2df573814aaafbb30747ec2cb544448028cb05366b4409e209bbe7970c836157e08cd0798c60
SSDEEP

24576:wNsfiTdYSuVzZH9tH1v1O3W3ZtxEVFxi1ABiu1:ET2pZ1O3WpHEV311

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
4776	4kvideodownloaderplus_1.3.0_x64_online.exe

Loads dropped DLL 1 IoCs

pid	Process
4776	4kvideodownloaderplus_1.3.0_x64_online.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4776	1396	4kvideodownloaderplus_1.3.0_x64_online.exe	88
PID 1396 wrote to memory of 4776	1396	4kvideodownloaderplus_1.3.0_x64_online.exe	88
PID 1396 wrote to memory of 4776	1396	4kvideodownloaderplus_1.3.0_x64_online.exe	88

C:\Users\Admin\AppData\Local\Temp\4kvideodownloaderplus_1.3.0_x64_online.exe
"C:\Users\Admin\AppData\Local\Temp\4kvideodownloaderplus_1.3.0_x64_online.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\Temp\{566C6BF7-9F31-48E1-93E3-50B1544ED925}\.cr\4kvideodownloaderplus_1.3.0_x64_online.exe
  "C:\Windows\Temp\{566C6BF7-9F31-48E1-93E3-50B1544ED925}\.cr\4kvideodownloaderplus_1.3.0_x64_online.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\4kvideodownloaderplus_1.3.0_x64_online.exe" -burn.filehandle.attached=544 -burn.filehandle.self=524
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{566C6BF7-9F31-48E1-93E3-50B1544ED925}\.cr\4kvideodownloaderplus_1.3.0_x64_online.exe

Filesize
393KB

MD5
c69801b47ee10b8eb8cfa143fcca8714

SHA1
fb98474c178d55fbf0ed56798b206635863c2311

SHA256
bb4c39b018789aa8ad8071cec7b37f9eefba4ad493392e6a1c58153913bd89d9

SHA512
8c91b05bccf8a4f111e8d2030c1b81ba641532cd3877c9c45376b4e094205d06507ff3736404e10d08cecf26bed737dfa08ea6a09607232168d0ce54b769e1af

Download Submit
C:\Windows\Temp\{566C6BF7-9F31-48E1-93E3-50B1544ED925}\.cr\4kvideodownloaderplus_1.3.0_x64_online.exe

Filesize
530KB

MD5
1bdef18f2bf5251ec808aea4b246955e

SHA1
0ed8fd8e3596502aa09b652274100695194016ab

SHA256
cf9a3e51a57aff41fc31abab3f3effc5075e4fc5a976f8ac5268818f62a709c5

SHA512
a80a899cf91b5cf7d7d41e0374ab2279d1d21d74744648d0987ebd5819cfcd7c01c314f66b3eac56b1268f5a6aeb6fb6f3b3fb0ecd12fe74f662e00d658aee42

Download Submit
C:\Windows\Temp\{C1A63189-A311-40DB-B9A6-9973772AFD48}\.ba\logo.png

Filesize
4KB

MD5
20986fecad1c10339e192993e72bbc4e

SHA1
ca627fc0a6e96c2021da63e71d5d05d45b9894b9

SHA256
2fab77079c0e9e6bae57c3f783936243a6f43550d08cab690c09b4409d4ea669

SHA512
4cbe6c6cfef20a770e6cb9303ceddf1f0b53a5c1a8a26a9c769fe72735a36a9646f6937c6f8af26d42b0bf9860638af80cb201e6551d41fd2c813bbda39d5990

Download Submit
C:\Windows\Temp\{C1A63189-A311-40DB-B9A6-9973772AFD48}\.ba\wixstdba.dll

Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit