6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/VC_redist.x64.exe
Size

24.1MB
MD5

0c86174ca06d892881301203cdf2c32d
SHA1

2b7462bb7732725f011a085349d6d206eed40048
SHA256

5d3d8c6779750f92f3726c70e92f0f8bf92d3ae2abd43ba28c6306466de8a144
SHA512

16c1b043c81394bab65b40c5a9c5b742300cb605d9780226af725bf4d6e38c701f604549b2a3b2138ae951aadfc53faea66c97268c8c61c6c4f0771426ecca62
SSDEEP

786432:4ipXDWoLTNOqMp5RUlODSV4YloO/Fa2XKS4POTsLK:JpXDhLTNJMpUEYloNS4PvLK

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2180	VC_redist.x64.exe

Loads dropped DLL 2 IoCs

pid	Process
2496	VC_redist.x64.exe
2180	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28
PID 2496 wrote to memory of 2180	2496	VC_redist.x64.exe	28

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\VC_redist.x64.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\VC_redist.x64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\Temp\{42970843-C5D3-47E6-9FFD-40CCA9852F36}\.cr\VC_redist.x64.exe
  "C:\Windows\Temp\{42970843-C5D3-47E6-9FFD-40CCA9852F36}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\VC_redist.x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{42970843-C5D3-47E6-9FFD-40CCA9852F36}\.cr\VC_redist.x64.exe

Filesize
431KB

MD5
531294caab33cfcb9ef1f80419a9de0a

SHA1
6db237e7092727b6683dfcc7ccb363d7115f3d2b

SHA256
18581503fa8a9895ab54f3193070bf226447ec131a79c38015095dcce46a6ba0

SHA512
94c481af6d3a377d30a5b0ac4fa2af63754357dc9ad36080224220dd07cf54c448bac389fb9bb20bc2fab70bf346fefaf70b22894d3f36a03d26b49e2a06109d

Download Submit
C:\Windows\Temp\{42970843-C5D3-47E6-9FFD-40CCA9852F36}\.cr\VC_redist.x64.exe

Filesize
634KB

MD5
464799b58f1090430afa4aa6183bedb6

SHA1
f2b3d878516031e4d968fa8d7b160a14e51688e8

SHA256
42305b0bdfc29a9b03bbbf17b0adc12146cdb37031ae51029b440d537f714571

SHA512
7ab70eb7fdcc107bc41c345b8ca7414ea40f7c3b566614d7767d5d9d93b84cb73d14e447b8a885ce71fb1c46a2469b825a56946a1ef7ac0f8ffdd3110f08d97b

Download Submit
C:\Windows\Temp\{B0F43304-1C85-41DC-BE2C-E1C955095383}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
\Windows\Temp\{42970843-C5D3-47E6-9FFD-40CCA9852F36}\.cr\VC_redist.x64.exe

Filesize
570KB

MD5
212906f1e78475921f8112a187e2a3c0

SHA1
f5be9b50b2b42afa5ac535cd19a4400e382e24e7

SHA256
527cd2190bc967b556ecfe3ed85825f7f634b5112557747df4e37ffae96b364b

SHA512
0f5c2eb5c42737cc4e4fd48fa8832d31e95519ecbed555be886901ac5246106226bb5e5a225937321963b9514a55dd1838553d0029513e26eeebb7d2ec50ad27

Download Submit
\Windows\Temp\{B0F43304-1C85-41DC-BE2C-E1C955095383}\.ba\wixstdba.dll

Filesize
126KB

MD5
027bba951e97243bb12fa8f2333303e7

SHA1
ecb6628301b229c3505686a7f95f034c81867c1d

SHA256
7459e6cdeee6e4ff984e4488820f9d66f379e7b5d1329d727795b46d5f3464fd

SHA512
0a879a7358da89872b2b7eeece2253ac7a0488a6c4f6b3e90081cdf308c4c43b4599c54091b9dc77913b4f00be5bcec5f90b7d63ac935a0277f296b579417c04

Download Submit