6bd6cd1c6bcfe0790fc8f5d50afa96c0b0d300c823952d98c68154e178bc5083

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AppSetup.exe
Size 446KB
Sample240122-xdf9bschc2
SHA256 12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10
MD5 485008b43f0edceba0e0d3ca04bc1c1a
SHA1 55ae8f105af415bb763d1b87f6572f078052877c
SHA512 402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1
SSDEEP 12288:vK5+DMJA3TAz4plk9iZOOti81N5y1qMIg+GV5Zul3M:y5+DMJA3TAz4plk9ijK1qlGV7ulM
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3852 set thread context of 220	3852	AppSetup.exe	88

Loads dropped DLL 1 IoCs

pid	Process
1272	RarExt32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3852	AppSetup.exe
3852	AppSetup.exe
220	cmd.exe
220	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3852	AppSetup.exe
220	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 220	3852	AppSetup.exe	88
PID 3852 wrote to memory of 220	3852	AppSetup.exe	88
PID 3852 wrote to memory of 220	3852	AppSetup.exe	88
PID 3852 wrote to memory of 220	3852	AppSetup.exe	88
PID 220 wrote to memory of 1272	220	cmd.exe	98
PID 220 wrote to memory of 1272	220	cmd.exe	98
PID 220 wrote to memory of 1272	220	cmd.exe	98
PID 220 wrote to memory of 1272	220	cmd.exe	98
PID 220 wrote to memory of 1272	220	cmd.exe	98
PID 220 wrote to memory of 1272	220	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\AppSetup.exe
"C:\Users\Admin\AppData\Local\Temp\AppSetup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Users\Admin\AppData\Local\Temp\RarExt32.exe
    C:\Users\Admin\AppData\Local\Temp\RarExt32.exe
    3⤵
    - Loads dropped DLL
    PID:1272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RarExt32.exe

Path C:\Users\Admin\AppData\Local\Temp\RarExt32.exe
Size 750KB
SHA256 fba6f7d8ba6b37b17266e8cb3e201ad0914c4a7b3f883ba954ed6d222f4268bc
MD5 f566af2bb0bb3be340dd7239163d8c9e
SHA1 fd891e25413b31d58e0b96288704606f535183e1
SHA512 7d85bab7fde596c52ffc5fe7fc3b4c022b5ed97149239932070135868c341b641350c8f2f099e9e5a5a17299fdc452f4919d85dba13b282fa6a1d3fb3481b342
SSDEEP 12288:lNwqTKb1SamXiYCtLvvIagsAgW3X0/ky50pztXer7gN9Foo4wFbF8nB1IRxAcflC:nPI1SjOJUikF5TRckR23E5rEu0I9kbv1
MD5 SHA1 SHA512 SSDEEP

Submit Download

a8a702e1

Path C:\Users\Admin\AppData\Local\Temp\a8a702e1
Size 38KB
SHA256 fd181a0cc49d38e4c45e4c36b654efe822659300a085211effafd373c0f5c6a1
MD5 cb3ec7614570b0175a15bf5bec352cc3
SHA1 bf59882ef0b07f1c3d66e382a7379e61913afb10
SHA512 9f67a645322412a787a19a4c79be90dc72033002828c7bd6a9268a60e597eba158b2e5d65dca66e67f56e8ba95f7724c2980d4832b215b8988fc46546baf2e5d
SSDEEP 384:3hAWeM5dQPtUfpwkCsXMKiIi1+3aOiZRrMrprZAjE8djywCgnwbTGjzTm:WM5d7mkCKv6+KHR9E8owCgMijG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-14-0x0000000075240000-0x00000000753BB000-memory.dmp

Download

memory/220-20-0x0000000075240000-0x00000000753BB000-memory.dmp

Download

memory/220-10-0x0000000075240000-0x00000000753BB000-memory.dmp

Download

memory/220-16-0x0000000075240000-0x00000000753BB000-memory.dmp

Download

memory/220-12-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Download

memory/1272-23-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Download

memory/1272-29-0x0000000000730000-0x00000000007B9000-memory.dmp

Download

memory/1272-33-0x0000000075240000-0x00000000753BB000-memory.dmp

Download

memory/1272-34-0x0000000075240000-0x00000000753BB000-memory.dmp

Download

memory/1272-32-0x0000000075240000-0x00000000753BB000-memory.dmp

Download

memory/1272-25-0x0000000075240000-0x00000000753BB000-memory.dmp

Download

memory/1272-22-0x0000000000730000-0x00000000007B9000-memory.dmp

Download

memory/1272-28-0x0000000000980000-0x0000000000981000-memory.dmp

Download

memory/1272-27-0x0000000075240000-0x00000000753BB000-memory.dmp

Download

memory/1272-26-0x0000000075240000-0x00000000753BB000-memory.dmp

Download

memory/1272-31-0x0000000000730000-0x00000000007B9000-memory.dmp

Download

memory/3852-0-0x0000000075240000-0x00000000753BB000-memory.dmp

Download

memory/3852-7-0x0000000075240000-0x00000000753BB000-memory.dmp

Download

memory/3852-1-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Download

memory/3852-8-0x0000000075240000-0x00000000753BB000-memory.dmp

Download