ffb7484dbd43f1a8de746604b64da32f8f408b8c76429cb8d36c0fe6c31d6438

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-02-2024 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dependencies/vcredist2008_x86.exe
Size

4.3MB
MD5

35da2bf2befd998980a495b6f4f55e60
SHA1

470640aa4bb7db8e69196b5edb0010933569e98d
SHA256

6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
SHA512

bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
SSDEEP

98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

install.exe

pid process

2664 install.exe
Loads dropped DLL 2 IoCs

Processes:

vcredist2008_x86.exeinstall.exe

pid process

1276 vcredist2008_x86.exe
2664 install.exe

pid	process
2664	install.exe

pid	process
1276	vcredist2008_x86.exe
2664	install.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

vcredist2008_x86.exe

description	pid	process	target process
PID 1276 wrote to memory of 2664	1276	vcredist2008_x86.exe	install.exe
PID 1276 wrote to memory of 2664	1276	vcredist2008_x86.exe	install.exe
PID 1276 wrote to memory of 2664	1276	vcredist2008_x86.exe	install.exe
PID 1276 wrote to memory of 2664	1276	vcredist2008_x86.exe	install.exe
PID 1276 wrote to memory of 2664	1276	vcredist2008_x86.exe	install.exe
PID 1276 wrote to memory of 2664	1276	vcredist2008_x86.exe	install.exe
PID 1276 wrote to memory of 2664	1276	vcredist2008_x86.exe	install.exe

C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2008_x86.exe
"C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2008_x86.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1276

\??\c:\11de2fe1703f64e00a0b\install.exe
c:\11de2fe1703f64e00a0b\.\install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\11de2fe1703f64e00a0b\install.exe
Filesize
547KB

MD5
4138c31964fbcb3b7418e086933324c3

SHA1
97cc6f58fb064ab6c4a2f02fb665fef77d30532f

SHA256
b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29

SHA512
40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557

Download Submit
\??\c:\11de2fe1703f64e00a0b\globdata.ini
Filesize
1KB

MD5
0a6b586fabd072bd7382b5e24194eac7

SHA1
60e3c7215c1a40fbfb3016d52c2de44592f8ca95

SHA256
7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

SHA512
b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

Download Submit
\??\c:\11de2fe1703f64e00a0b\install.ini
Filesize
841B

MD5
f8f6c0e030cb622f065fe47d61da91d7

SHA1
cf6fa99747de8f35c6aea52df234c9c57583baa3

SHA256
c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d

SHA512
b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde

Download Submit
\??\c:\11de2fe1703f64e00a0b\install.res.1033.dll
Filesize
85KB

MD5
ff6003014eefc9c30abe20e3e1f5fbe8

SHA1
4a5bd05f94545f01efc10232385b8fecad300678

SHA256
a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067

SHA512
3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2

Download Submit
\??\c:\11de2fe1703f64e00a0b\vc_red.msi
Filesize
172KB

MD5
151e919583734a547868df45e14152b2

SHA1
fb3ae7b8298691030c62c2442b4181cb0dc63dd0

SHA256
d24d656c23a670747b1235da785f9e04ba74a9cb8bb829b8b67d2411ba1f1171

SHA512
9c2607b07a6b761ac1fc1eee78f94c37e4a667d55086de2022ef227aeefe2af7647ae0775415c7f05f1fd884a821d7e0a57957e1b09cc5611d906b3f8fc7abab

Download Submit
\??\c:\11de2fe1703f64e00a0b\vcredist.bmp
Filesize
5KB

MD5
06fba95313f26e300917c6cea4480890

SHA1
31beee44776f114078fc403e405eaa5936c4bc3b

SHA256
594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1

SHA512
7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd

Download Submit
memory/2664-34-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2664-37-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads