6bd6cd1c6bcfe0790fc8f5d50afa96c0b0d300c823952d98c68154e178bc5083

Analysis

max time kernel
143s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AppSetup.exe
Size 446KB
Sample240122-xdf9bschc2
SHA256 12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10
MD5 485008b43f0edceba0e0d3ca04bc1c1a
SHA1 55ae8f105af415bb763d1b87f6572f078052877c
SHA512 402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1
SSDEEP 12288:vK5+DMJA3TAz4plk9iZOOti81N5y1qMIg+GV5Zul3M:y5+DMJA3TAz4plk9ijK1qlGV7ulM
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 2792	2164	AppSetup.exe	29

Loads dropped DLL 7 IoCs

pid	Process
2792	cmd.exe
1292	RarExt32.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	1292	WerFault.exe	31

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2164	AppSetup.exe
2164	AppSetup.exe
2792	cmd.exe
2792	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2164	AppSetup.exe
2792	cmd.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2792	2164	AppSetup.exe	29
PID 2164 wrote to memory of 2792	2164	AppSetup.exe	29
PID 2164 wrote to memory of 2792	2164	AppSetup.exe	29
PID 2164 wrote to memory of 2792	2164	AppSetup.exe	29
PID 2164 wrote to memory of 2792	2164	AppSetup.exe	29
PID 2792 wrote to memory of 1292	2792	cmd.exe	31
PID 2792 wrote to memory of 1292	2792	cmd.exe	31
PID 2792 wrote to memory of 1292	2792	cmd.exe	31
PID 2792 wrote to memory of 1292	2792	cmd.exe	31
PID 2792 wrote to memory of 1292	2792	cmd.exe	31
PID 2792 wrote to memory of 1292	2792	cmd.exe	31
PID 1292 wrote to memory of 2636	1292	RarExt32.exe	32
PID 1292 wrote to memory of 2636	1292	RarExt32.exe	32
PID 1292 wrote to memory of 2636	1292	RarExt32.exe	32
PID 1292 wrote to memory of 2636	1292	RarExt32.exe	32
PID 2792 wrote to memory of 1292	2792	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\AppSetup.exe
"C:\Users\Admin\AppData\Local\Temp\AppSetup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\RarExt32.exe
    C:\Users\Admin\AppData\Local\Temp\RarExt32.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 104
      4⤵
      Loads dropped DLL
      Program crash
      PID:2636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

245dc2d4

Path C:\Users\Admin\AppData\Local\Temp\245dc2d4
Size 288KB
SHA256 ac850e179b6091d537cfee23e8f906b907633e812784672a71680282ebe2a003
MD5 7ca46c4d00b5d72fd7c9043d3aa4b5d1
SHA1 e2eb2d7a8fb6ea42a023355af3bfe19beff642ad
SHA512 f423ee0a4fe1643a573ee77daee18e3de9a06e80bae4f71f82fc8643b88d52efaa845fe2be9a53a9895fc66e50cfa4808bc2e37c6915b599db524ee72ebaa4f4
SSDEEP 6144:/hysXhmHyjrD1YfBB5bgPvmLRzWWTvj1tvUDiK:/nmShYfBB+mLD2
MD5 SHA1 SHA512 SSDEEP

Submit Download

RarExt32.exe

Path \Users\Admin\AppData\Local\Temp\RarExt32.exe
Size 750KB
SHA256 fba6f7d8ba6b37b17266e8cb3e201ad0914c4a7b3f883ba954ed6d222f4268bc
MD5 f566af2bb0bb3be340dd7239163d8c9e
SHA1 fd891e25413b31d58e0b96288704606f535183e1
SHA512 7d85bab7fde596c52ffc5fe7fc3b4c022b5ed97149239932070135868c341b641350c8f2f099e9e5a5a17299fdc452f4919d85dba13b282fa6a1d3fb3481b342
SSDEEP 12288:lNwqTKb1SamXiYCtLvvIagsAgW3X0/ky50pztXer7gN9Foo4wFbF8nB1IRxAcflC:nPI1SjOJUikF5TRckR23E5rEu0I9kbv1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1292-22-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/1292-20-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/1292-33-0x0000000000400000-0x0000000000489000-memory.dmp

Download

memory/1292-31-0x0000000000400000-0x0000000000489000-memory.dmp

Download

memory/1292-25-0x0000000000100000-0x0000000000101000-memory.dmp

Download

memory/1292-24-0x00000000775D0000-0x0000000077779000-memory.dmp

Download

memory/2164-0-0x0000000074B10000-0x0000000074C84000-memory.dmp

Download

memory/2164-1-0x00000000775D0000-0x0000000077779000-memory.dmp

Download

memory/2164-8-0x0000000074B10000-0x0000000074C84000-memory.dmp

Download

memory/2164-7-0x0000000074B10000-0x0000000074C84000-memory.dmp

Download

memory/2792-21-0x0000000074B10000-0x0000000074C84000-memory.dmp

Download

memory/2792-15-0x0000000074B10000-0x0000000074C84000-memory.dmp

Download

memory/2792-14-0x0000000074B10000-0x0000000074C84000-memory.dmp

Download

memory/2792-12-0x00000000775D0000-0x0000000077779000-memory.dmp

Download

memory/2792-10-0x0000000074B10000-0x0000000074C84000-memory.dmp

Download