6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/VC_redist.x64.exe
Size 24.1MB
Sample240213-w2b4vaeh8y
SHA256 5d3d8c6779750f92f3726c70e92f0f8bf92d3ae2abd43ba28c6306466de8a144
MD5 0c86174ca06d892881301203cdf2c32d
SHA1 2b7462bb7732725f011a085349d6d206eed40048
SHA512 16c1b043c81394bab65b40c5a9c5b742300cb605d9780226af725bf4d6e38c701f604549b2a3b2138ae951aadfc53faea66c97268c8c61c6c4f0771426ecca62
SSDEEP 786432:4ipXDWoLTNOqMp5RUlODSV4YloO/Fa2XKS4POTsLK:JpXDhLTNJMpUEYloNS4PvLK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2180	VC_redist.x64.exe

Loads dropped DLL 2 IoCs

pid	Process
2496	VC_redist.x64.exe
2180	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\VC_redist.x64.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\VC_redist.x64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\Temp\{42970843-C5D3-47E6-9FFD-40CCA9852F36}\.cr\VC_redist.x64.exe
  "C:\Windows\Temp\{42970843-C5D3-47E6-9FFD-40CCA9852F36}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\VC_redist.x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VC_redist.x64.exe

Path C:\Windows\Temp\{42970843-C5D3-47E6-9FFD-40CCA9852F36}\.cr\VC_redist.x64.exe
Size 431KB
SHA256 18581503fa8a9895ab54f3193070bf226447ec131a79c38015095dcce46a6ba0
MD5 531294caab33cfcb9ef1f80419a9de0a
SHA1 6db237e7092727b6683dfcc7ccb363d7115f3d2b
SHA512 94c481af6d3a377d30a5b0ac4fa2af63754357dc9ad36080224220dd07cf54c448bac389fb9bb20bc2fab70bf346fefaf70b22894d3f36a03d26b49e2a06109d
SSDEEP 12288:anMwHskY7gjcjhVIEhqgM7bWvcsi6aVvh:UMysZgjS1hqgSC/izZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VC_redist.x64.exe

Path C:\Windows\Temp\{42970843-C5D3-47E6-9FFD-40CCA9852F36}\.cr\VC_redist.x64.exe
Size 634KB
SHA256 42305b0bdfc29a9b03bbbf17b0adc12146cdb37031ae51029b440d537f714571
MD5 464799b58f1090430afa4aa6183bedb6
SHA1 f2b3d878516031e4d968fa8d7b160a14e51688e8
SHA512 7ab70eb7fdcc107bc41c345b8ca7414ea40f7c3b566614d7767d5d9d93b84cb73d14e447b8a885ce71fb1c46a2469b825a56946a1ef7ac0f8ffdd3110f08d97b
SSDEEP 12288:anMwHskY7gjcjhVIEhqgM7bWvcsi6aVvrIy1U40vy3W/ceKSHMsiFyY6XNpao:UMysZgjS1hqgSC/izTf+jymk4HM5yJpr
MD5 SHA1 SHA512 SSDEEP

Submit Download

logo.png

Path C:\Windows\Temp\{B0F43304-1C85-41DC-BE2C-E1C955095383}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
MD5 SHA1 SHA512

Submit Download

VC_redist.x64.exe

Path \Windows\Temp\{42970843-C5D3-47E6-9FFD-40CCA9852F36}\.cr\VC_redist.x64.exe
Size 570KB
SHA256 527cd2190bc967b556ecfe3ed85825f7f634b5112557747df4e37ffae96b364b
MD5 212906f1e78475921f8112a187e2a3c0
SHA1 f5be9b50b2b42afa5ac535cd19a4400e382e24e7
SHA512 0f5c2eb5c42737cc4e4fd48fa8832d31e95519ecbed555be886901ac5246106226bb5e5a225937321963b9514a55dd1838553d0029513e26eeebb7d2ec50ad27
SSDEEP 12288:anMwHskY7gjcjhVIEhqgM7bWvcsi6aVvrIy1U40vy3W/ceKSHMsiFy+:UMysZgjS1hqgSC/izTf+jymk4HM5y+
MD5 SHA1 SHA512 SSDEEP

Submit Download

wixstdba.dll

Path \Windows\Temp\{B0F43304-1C85-41DC-BE2C-E1C955095383}\.ba\wixstdba.dll
Size 126KB
SHA256 7459e6cdeee6e4ff984e4488820f9d66f379e7b5d1329d727795b46d5f3464fd
MD5 027bba951e97243bb12fa8f2333303e7
SHA1 ecb6628301b229c3505686a7f95f034c81867c1d
SHA512 0a879a7358da89872b2b7eeece2253ac7a0488a6c4f6b3e90081cdf308c4c43b4599c54091b9dc77913b4f00be5bcec5f90b7d63ac935a0277f296b579417c04
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53E/:OXoQNb++gDrSJdr8BHkPh3W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads