Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:48
Static task
static1
Behavioral task
behavioral1
Sample
7502530c6ed33f19ee87a18c8478d0b8.exe
Resource
win7-20231215-en
General
-
Target
7502530c6ed33f19ee87a18c8478d0b8.exe
-
Size
640KB
-
MD5
7502530c6ed33f19ee87a18c8478d0b8
-
SHA1
a58e62c49ef435504c0fce6d8a10284c70f91568
-
SHA256
92d24d207cc8b8fc6dbf48bdcc31e79d2890cf99c55c7b5cb1bc8fd3bdb4cb2d
-
SHA512
48201061144cd25cac49490604a675be75e9b3f97473eb7ca65865676a5f5dbe85da3c3bb7860b99569488587d560cd2770229cfd7568ed508065e80f5ceca99
-
SSDEEP
12288:5na9giX+IuJQH5Gr+xgAW7NY3hktqFrZOtcvS38LCJQBtdGs1rBLsJ:5na2DcQKNWFtNkS3rJQBtUkBgJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
7502530c6ed33f19ee87a18c8478d0b8.tmppid process 2408 7502530c6ed33f19ee87a18c8478d0b8.tmp -
Loads dropped DLL 5 IoCs
Processes:
7502530c6ed33f19ee87a18c8478d0b8.exe7502530c6ed33f19ee87a18c8478d0b8.tmppid process 2512 7502530c6ed33f19ee87a18c8478d0b8.exe 2408 7502530c6ed33f19ee87a18c8478d0b8.tmp 2408 7502530c6ed33f19ee87a18c8478d0b8.tmp 2408 7502530c6ed33f19ee87a18c8478d0b8.tmp 2408 7502530c6ed33f19ee87a18c8478d0b8.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7502530c6ed33f19ee87a18c8478d0b8.tmppid process 2408 7502530c6ed33f19ee87a18c8478d0b8.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
7502530c6ed33f19ee87a18c8478d0b8.exedescription pid process target process PID 2512 wrote to memory of 2408 2512 7502530c6ed33f19ee87a18c8478d0b8.exe 7502530c6ed33f19ee87a18c8478d0b8.tmp PID 2512 wrote to memory of 2408 2512 7502530c6ed33f19ee87a18c8478d0b8.exe 7502530c6ed33f19ee87a18c8478d0b8.tmp PID 2512 wrote to memory of 2408 2512 7502530c6ed33f19ee87a18c8478d0b8.exe 7502530c6ed33f19ee87a18c8478d0b8.tmp PID 2512 wrote to memory of 2408 2512 7502530c6ed33f19ee87a18c8478d0b8.exe 7502530c6ed33f19ee87a18c8478d0b8.tmp PID 2512 wrote to memory of 2408 2512 7502530c6ed33f19ee87a18c8478d0b8.exe 7502530c6ed33f19ee87a18c8478d0b8.tmp PID 2512 wrote to memory of 2408 2512 7502530c6ed33f19ee87a18c8478d0b8.exe 7502530c6ed33f19ee87a18c8478d0b8.tmp PID 2512 wrote to memory of 2408 2512 7502530c6ed33f19ee87a18c8478d0b8.exe 7502530c6ed33f19ee87a18c8478d0b8.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\7502530c6ed33f19ee87a18c8478d0b8.exe"C:\Users\Admin\AppData\Local\Temp\7502530c6ed33f19ee87a18c8478d0b8.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\is-8EDBH.tmp\7502530c6ed33f19ee87a18c8478d0b8.tmp"C:\Users\Admin\AppData\Local\Temp\is-8EDBH.tmp\7502530c6ed33f19ee87a18c8478d0b8.tmp" /SL5="$40110,356929,54272,C:\Users\Admin\AppData\Local\Temp\7502530c6ed33f19ee87a18c8478d0b8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2408
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-LOL6S.tmp\Games.infFilesize
254B
MD5aec80ad0946e82e8d3912245d120d3c7
SHA17ec963f826b5f70dea0aa8b8444148faa603f9ad
SHA25649ab6a1e5497ca2440092e7c9163f631e4c282db1bc2ec070557cdb293976e12
SHA512401e4429fba26c3da6cd387efbabdea4c8ea09c589a25b00c61156c2f513c720c0fe2fd8d07dabc6c41ab816d9343d263c8714e0ad68b253d796cf82bef3a308
-
\Users\Admin\AppData\Local\Temp\is-8EDBH.tmp\7502530c6ed33f19ee87a18c8478d0b8.tmpFilesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
-
\Users\Admin\AppData\Local\Temp\is-LOL6S.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-LOL6S.tmp\isxdl.dllFilesize
49KB
MD502ecc74f7f91e9ffd84de708683236a6
SHA13532de0b77df8b0fc89e9c7eddec3fa71f98f5a2
SHA25630ad8a0e1cee091ca48c771adb2e76baf1a7d54b9f60dc47f54dfdc2d6f6691e
SHA512a3fdaa651f82428395bc412a2a04fce673768d3ef088b3748addf337d95464eb141ae7c286bff5c705eae05dd7b38207629588ae7e89ada15269463cd7acf541
-
\Users\Admin\AppData\Local\Temp\is-LOL6S.tmp\itdownload.dllFilesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
memory/2408-8-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2408-18-0x00000000005C0000-0x00000000005FC000-memory.dmpFilesize
240KB
-
memory/2408-36-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/2408-37-0x00000000005C0000-0x00000000005FC000-memory.dmpFilesize
240KB
-
memory/2408-41-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2512-1-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2512-35-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB