561166e046e0c9351a71dbecaf107524bfde28b2b2235c6094e9353eb8b905f7

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5038852ad549130a2de7bdd07ba5a092.exe
Size

1.0MB
MD5

5038852ad549130a2de7bdd07ba5a092
SHA1

0a70bc64a31527f0f9f2c690db1431991e69db39
SHA256

561166e046e0c9351a71dbecaf107524bfde28b2b2235c6094e9353eb8b905f7
SHA512

f3860b700f6ba61b5badf1c638b222371eaa469f15860fe226c28426fe5c4441591a4d83ee1865da5484ef7ea814cafb9b52a074720842d43e445a49c3eac4ac
SSDEEP

24576:5nah+U65QPZ1FzKz4b9wsiwMXoEE8zE0kS3rJQBtUkBgJ:5akj52P9n3i9X1HinXBgJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1616	5038852ad549130a2de7bdd07ba5a092.tmp

Loads dropped DLL 3 IoCs

pid	Process
1616	5038852ad549130a2de7bdd07ba5a092.tmp
1616	5038852ad549130a2de7bdd07ba5a092.tmp
1616	5038852ad549130a2de7bdd07ba5a092.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1616	2072	5038852ad549130a2de7bdd07ba5a092.exe	90
PID 2072 wrote to memory of 1616	2072	5038852ad549130a2de7bdd07ba5a092.exe	90
PID 2072 wrote to memory of 1616	2072	5038852ad549130a2de7bdd07ba5a092.exe	90

C:\Users\Admin\AppData\Local\Temp\5038852ad549130a2de7bdd07ba5a092.exe
"C:\Users\Admin\AppData\Local\Temp\5038852ad549130a2de7bdd07ba5a092.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\is-04MPI.tmp\5038852ad549130a2de7bdd07ba5a092.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-04MPI.tmp\5038852ad549130a2de7bdd07ba5a092.tmp" /SL5="$6004A,639565,54272,C:\Users\Admin\AppData\Local\Temp\5038852ad549130a2de7bdd07ba5a092.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-04MPI.tmp\5038852ad549130a2de7bdd07ba5a092.tmp

Filesize
130KB

MD5
e49d7590e2df5710b65f10107c0c4add

SHA1
fcd1e374d87533a77980f83bd9087a2e40444c25

SHA256
287eb52f88147ce58b4bc02ffc3e370279a2db0889702b9c31c0a17daf63707a

SHA512
0abe1353e511aaa2d6a97729133a8a5996b11ed3bf5bbe378cb5f783890b2cf755715f47315cb91a0484af1baf3eeeedd670e2b515baf5f28ed762cabcc7f13a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-04MPI.tmp\5038852ad549130a2de7bdd07ba5a092.tmp

Filesize
95KB

MD5
dfba37f034cb2d34f618f1022f8080b2

SHA1
ffa4fedcd2a14154b84bfa9153d309337d906e68

SHA256
f2c0649bbfb35ef9e5b71564f0434a939458952bbd953737582aa76fa39e1bbe

SHA512
3af56ef51636300e567187f0a149a8b195fe52bc33b341cb83127546fc6c99c1221d7986d426c645988ac92b37bc97f7b7abf7465e31904275e9fe503b3213c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DNF4V.tmp\Games.inf

Filesize
240B

MD5
ab8d464ec960aee1c851841b4552c414

SHA1
52c129915966e185d93ca0d14aa8996e1cd5e5bf

SHA256
bbbedc3f68a2b890eb2992b309d308243628b6629691ebe110191a48f92ea692

SHA512
c4251ef3cc30d88edd7a2b77f71c5546d25db05ea76663d2e83eb759fb7c653acab4ec8c14a6077fd1f667cb4b507a41ead0d573f86dd5d5487d53e80f9c6e4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DNF4V.tmp\isxdl.dll

Filesize
49KB

MD5
02ecc74f7f91e9ffd84de708683236a6

SHA1
3532de0b77df8b0fc89e9c7eddec3fa71f98f5a2

SHA256
30ad8a0e1cee091ca48c771adb2e76baf1a7d54b9f60dc47f54dfdc2d6f6691e

SHA512
a3fdaa651f82428395bc412a2a04fce673768d3ef088b3748addf337d95464eb141ae7c286bff5c705eae05dd7b38207629588ae7e89ada15269463cd7acf541

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DNF4V.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
memory/1616-17-0x0000000002620000-0x000000000265C000-memory.dmp

Filesize
240KB

Download
memory/1616-7-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/1616-37-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1616-38-0x0000000002620000-0x000000000265C000-memory.dmp

Filesize
240KB

Download
memory/1616-42-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/2072-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2072-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2072-36-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads