ae4c183ec26477621e0ea4e0b8e0c4bc6f8ad7d4326d57313a95228c23f0b7d9

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fc569f477f344b604a3ad6195aaeb71.exe
Size

346KB
MD5

6fc569f477f344b604a3ad6195aaeb71
SHA1

86dc248938955fdc2d5386f167774633c556e04f
SHA256

ae4c183ec26477621e0ea4e0b8e0c4bc6f8ad7d4326d57313a95228c23f0b7d9
SHA512

e29e92dcc7e3ecb51d18d78d460b9c1ab142c455dde3dfe1602acdc28881fb3eb887c6105ba900b0a739b3fba1365e903f99502ede3b8138fd13d131120a5dd9
SSDEEP

6144:Pq4UF8r+qQFEikycblAoHsycbJB9hUGK7xQdIe0pBIE90DtoSr:7T74Hrr9hUGMQKewBIECoSr

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
968	winrsys.exe

Loads dropped DLL 2 IoCs

pid	Process
968	winrsys.exe
968	winrsys.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\winrar\winrsys.exe	6fc569f477f344b604a3ad6195aaeb71.exe
File opened for modification	C:\Program Files (x86)\winrar\winrsys.exe	6fc569f477f344b604a3ad6195aaeb71.exe
File created	C:\Program Files (x86)\winrar\LCOOHT.DAT	6fc569f477f344b604a3ad6195aaeb71.exe
File opened for modification	C:\Program Files (x86)\winrar\LCOOHT.DAT	6fc569f477f344b604a3ad6195aaeb71.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
968	winrsys.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
968	winrsys.exe
968	winrsys.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4556	968	winrsys.exe	89
PID 968 wrote to memory of 4556	968	winrsys.exe	89

C:\Users\Admin\AppData\Local\Temp\6fc569f477f344b604a3ad6195aaeb71.exe
"C:\Users\Admin\AppData\Local\Temp\6fc569f477f344b604a3ad6195aaeb71.exe"
1⤵
- Drops file in Program Files directory
PID:1828

C:\Program Files (x86)\winrar\winrsys.exe
"C:\Program Files (x86)\winrar\winrsys.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\winrar\LCOOHT.DAT

Filesize
28KB

MD5
a2476cfa2705b4b904ac0c800bc4b2d1

SHA1
d577dfe4cafd7b6737fe582914a88d9f19b5fd49

SHA256
f49914005f18c22a2eec48bc602f1d0f4fb59e91226f3fda27cf04e6d198f7c3

SHA512
fd79959ef2f3809d5caf835778e714d8afb5a81bddb947c58cd848b3e4fbf4b50038d43dac66b70441ae786f813acff0485040b0be8e0e43a771b108f5ae02e4

Download Submit
C:\Program Files (x86)\winrar\winrsys.exe

Filesize
346KB

MD5
6fc569f477f344b604a3ad6195aaeb71

SHA1
86dc248938955fdc2d5386f167774633c556e04f

SHA256
ae4c183ec26477621e0ea4e0b8e0c4bc6f8ad7d4326d57313a95228c23f0b7d9

SHA512
e29e92dcc7e3ecb51d18d78d460b9c1ab142c455dde3dfe1602acdc28881fb3eb887c6105ba900b0a739b3fba1365e903f99502ede3b8138fd13d131120a5dd9

Download Submit
memory/968-8-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/968-9-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/968-14-0x00000000016B0000-0x00000000016D0000-memory.dmp

Filesize
128KB

Download
memory/968-15-0x00000000016B0000-0x00000000016D0000-memory.dmp

Filesize
128KB

Download
memory/968-16-0x00000000016B0000-0x00000000016D0000-memory.dmp

Filesize
128KB

Download
memory/968-17-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/968-19-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/1828-0-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1828-5-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/1828-10-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download