4b1f3e26de59fb0bf25a7d30d0abd4494166ba24a602876e8b138332707749c1

Analysis

max time kernel
141s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a251be015c5652188127d4a8c73e3b30.exe
Size 209KB
Sample240224-vs6fnaaa6z
SHA256 4b1f3e26de59fb0bf25a7d30d0abd4494166ba24a602876e8b138332707749c1
MD5 a251be015c5652188127d4a8c73e3b30
SHA1 315e801c4d98f3c90e91bb2d3187c5590b809f1d
SHA512 fa356195d27192b2dd9f828764fdcc8b9b4d1fba25b85c217c913200be9113c151c4979ffb8c523ea4d2d5a4867c305129fa6988003713f06779982549c360e2
SSDEEP 6144:Dl0n6aureEyrCChJk92TOsKQSflpb43F5n5o:an6auNATi2TAZ/eF55
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4412	u.dll
4380	mpress.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2032	OpenWith.exe
4916	OpenWith.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 4444	1840	a251be015c5652188127d4a8c73e3b30.exe	88
PID 1840 wrote to memory of 4444	1840	a251be015c5652188127d4a8c73e3b30.exe	88
PID 1840 wrote to memory of 4444	1840	a251be015c5652188127d4a8c73e3b30.exe	88
PID 4444 wrote to memory of 4412	4444	cmd.exe	89
PID 4444 wrote to memory of 4412	4444	cmd.exe	89
PID 4444 wrote to memory of 4412	4444	cmd.exe	89
PID 4412 wrote to memory of 4380	4412	u.dll	93
PID 4412 wrote to memory of 4380	4412	u.dll	93
PID 4412 wrote to memory of 4380	4412	u.dll	93
PID 4444 wrote to memory of 3908	4444	cmd.exe	94
PID 4444 wrote to memory of 3908	4444	cmd.exe	94
PID 4444 wrote to memory of 3908	4444	cmd.exe	94
PID 4444 wrote to memory of 2500	4444	cmd.exe	96
PID 4444 wrote to memory of 2500	4444	cmd.exe	96
PID 4444 wrote to memory of 2500	4444	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\a251be015c5652188127d4a8c73e3b30.exe
"C:\Users\Admin\AppData\Local\Temp\a251be015c5652188127d4a8c73e3b30.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3EED.tmp\vir.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Users\Admin\AppData\Local\Temp\u.dll
    u.dll -bat vir.bat -save a251be015c5652188127d4a8c73e3b30.exe.com -include s.dll -overwrite -nodelete
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\4035.tmp\mpress.exe
      "C:\Users\Admin\AppData\Local\Temp\4035.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe4036.tmp"
      4⤵
      Executes dropped EXE
      PID:4380
- - C:\Windows\SysWOW64\calc.exe
    CALC.EXE
    3⤵
    - Modifies registry class
    PID:3908
- - C:\Windows\SysWOW64\calc.exe
    CALC.EXE
    3⤵
    - Modifies registry class
    PID:2500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

vir.bat

Path C:\Users\Admin\AppData\Local\Temp\3EED.tmp\vir.bat
Size 1KB
SHA256 7f79eaea7ca06cb603850dee69a5cabc621ddd02f84aacd8004ab1cab86ebb5c
MD5 b3cd89243ea07000ed65d9436b5503fb
SHA1 f9683f912d08ce499e6a2dfb419b190d97b41068
SHA512 24fa47886195961fbeee8ce3da5d47295d2be6b7c8404a18c731118ee1cf6c8e8cdac901db5cc9afc7c153d5647dbd03ccf7cf8bbdeb0bc6b7716de1a02ca674
MD5 SHA1 SHA512

Submit Download

mpress.exe

Path C:\Users\Admin\AppData\Local\Temp\4035.tmp\mpress.exe
Size 100KB
SHA256 7c24c72439880e502be51da5d991b9b56a1af242b4eef4737f0f43b4a87546d2
MD5 e42b81b9636152c78ba480c1c47d3c7f
SHA1 66a2fca3925428ee91ad9df5b76b90b34d28e0f8
SHA512 4b2986106325c5c3fe11ab460f646d4740eb85252aa191f2b84e29901fac146d7a82e31c72d39c38a70277f78278621ee506d9da2681f5019cd64c7df85cff6e
SSDEEP 1536:k0d2QHvIezyfLHUvtLgFki03GxdhxF+gINFa9E9xYpfCJ2P7PomYGAj0kAYamzn:kG2QPGjIg02rF+PRj6fCuAmYGGZL
MD5 SHA1 SHA512 SSDEEP

Submit Download

exe4036.tmp

Path C:\Users\Admin\AppData\Local\Temp\exe4036.tmp
Size 41KB
SHA256 75e8f3a8df737002f0d4be1064a96490ca1c56148ea69781abaaa6299eff9b21
MD5 71ce3645ecf4a753408f77c5a8bad638
SHA1 9b8252af055414bb69e5ce0f1826066c27c0d63e
SHA512 79a8d69275afc627a9102e62f05d3867ef013a11c174dd4981fe31494d3f6e127032fdcc92fae99aaac2a485a6acdf0d7fdf6df120c53a024740ff1786f51c6e
SSDEEP 768:hTlAgq30fNHGG0veaq1sBCpouTDdwIBljrkieu3jw3o+//ypB3:hT6Leaq1hj5Qir3j7+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

exe4036.tmp

Path C:\Users\Admin\AppData\Local\Temp\exe4036.tmp
Size 41KB
SHA256 f2162f46ba244b63745eb26b145b6157a2b19327643fbf11a100ba91bc49a70d
MD5 9eac72f10c1aa921f0d3711a7e027435
SHA1 4961bc3905aae2823de1c7582104a63b04676a0d
SHA512 ef4017f7d22d254f2a4ad14fd78917f28157d4964f8386ce95b3db5130e7f19c05c6a271687c50cf26487dd43ef118ed39b7e4a2ec60d165cde98d8c21e481df
SSDEEP 768:h7lAgq30fNHGG0veaq1sBCpouTDdwIBljrkieu3jw3o+//ypBm:h76Leaq1hj5Qir3j7+1
MD5 SHA1 SHA512 SSDEEP

Submit Download

mpr418D.tmp

Path C:\Users\Admin\AppData\Local\Temp\mpr418D.tmp
Size 24KB
SHA256 cdd444099bce2cf6dd603ad194c329ad6d72648c8680b7ea7bcae1ec9ed15543
MD5 f33dfc0cd5bd3bb402cb355a9d8c5a52
SHA1 da84c836f26a18c7a7bafc6fca5278801318ee74
SHA512 74d71cd561d4e7103033c1f132fa87fe0175207184da0439127bc7f2c5c2234580650d1506c04a9ff8d86fe935d635b4d5beffba5930bccf5d9bd3c01d5feb03
SSDEEP 768:e3HKmM0qauedykJ7BFjKcFNkZmGKAr7D:e6mMyl7BFGSsZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

s.dll

Path C:\Users\Admin\AppData\Local\Temp\s.dll
Size 700KB
SHA256 c7b97a001b39e17382e929aad924555f3d21886b86aed38cffd660490801d1d6
MD5 3c9568b0d86a865f9f73d9c0967cfdad
SHA1 3270df3e0e600f4df2c3cbc384837693a8a3a83e
SHA512 bd423d1d57823b1bf6db42aeec199aa93178a9317ead85b42b60e091aaf4f73ce721bc07fda4750e112c4dccb9d87e21d5793965da9d6e92b0c5bed92c26876f
SSDEEP 12288:JSpDS5cTfsrtPdOy4nVY5/pBdNQxIJBiVhwFAY0WjvI:JSY5cHY5PogiVmFM4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

vir.bat

Path C:\Users\Admin\AppData\Local\Temp\vir.bat
Size 1KB
SHA256 8557d664bd7d9cf880f37ea432d5ff644ee8dab304b2b8c98247961faa45be50
MD5 68305dbec27e7975d598c852acc7e9ec
SHA1 2a5d3ca4eec9a67f9dd38ae81fb373a20d7ac763
SHA512 4ed427a1fad3e9d61d954060c5f21e30f0058b90b65d744f2555bce05186cb780913264148564bf37515c837fc4c4f061b3e98a4fd24be3ac25971120c183d44
MD5 SHA1 SHA512

Submit Download

memory/1840-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/1840-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/1840-69-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4380-54-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4380-61-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads