43358b1bf2342e4c45179ffe1eba80b41fe64ca7aba3cf0e551f5ceada787b59

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/03/2024, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/MobilewitchAcPro.exe
Size 566KB
Sample240321-elpassbd94
SHA256 f814fb9389012186ee85a6bb613f03f5fb5646b1faac33a755122dfecb0beb40
MD5 9c4e9c3250820793320da7f10b71870d
SHA1 06a06f2d716f773089455613e14f6757d06c60f5
SHA512 3a3daee92d59bedc78622940bfa72025ca3244ef3564349711b1117f631667e92136a562f83994075bd9e908e534abb2217dff8601dcfc94bd64a2cf52e32259
SSDEEP 12288:mna9iuosHV56Tot2CIVgurymne2Q42l1/6tU4fi5roERzj6w:mnak6bswOeSYR6lUdVuw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3012	MobilewitchAcPro.tmp

Loads dropped DLL 4 IoCs

pid	Process
2932	MobilewitchAcPro.exe
3012	MobilewitchAcPro.tmp
3012	MobilewitchAcPro.tmp
3012	MobilewitchAcPro.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3012	MobilewitchAcPro.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3012	2932	MobilewitchAcPro.exe	28
PID 2932 wrote to memory of 3012	2932	MobilewitchAcPro.exe	28
PID 2932 wrote to memory of 3012	2932	MobilewitchAcPro.exe	28
PID 2932 wrote to memory of 3012	2932	MobilewitchAcPro.exe	28
PID 2932 wrote to memory of 3012	2932	MobilewitchAcPro.exe	28
PID 2932 wrote to memory of 3012	2932	MobilewitchAcPro.exe	28
PID 2932 wrote to memory of 3012	2932	MobilewitchAcPro.exe	28

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MobilewitchAcPro.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MobilewitchAcPro.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\is-SCOM3.tmp\MobilewitchAcPro.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-SCOM3.tmp\MobilewitchAcPro.tmp" /SL5="$50150,285429,53760,C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MobilewitchAcPro.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

IssProc.dll

Path \Users\Admin\AppData\Local\Temp\is-N9OSR.tmp\IssProc.dll
Size 184KB
SHA256 154cb086cf647d673cc0646ab3db30e2c68974743eb8348cd3d77113bd15d18b
MD5 8eae382eabf41d58cb4e4f6bccb48bca
SHA1 104b402efcf67cfb885d3d5f2c3cbad9837c6fd2
SHA512 bc1d46e2b91b51c2adb84f6fa08cb5c0c95909fd7761e0a19a6db8e7f6a0e768d575530dd920e722ba5440cfcdee48677d3260bae473bced72a1a1c62ab0e469
SSDEEP 3072:K7C2KgThNpwEPAkRoA2Pdrw6nUiYqmNY2SZO5gx9LkzZALrMsp6Pr1fvIKEdTzuM:gD7jpwEPAZAe/UX3N7qLrMsp6Pr1fvIV
MD5 SHA1 SHA512 SSDEEP

Submit Download

_shfoldr.dll

Path \Users\Admin\AppData\Local\Temp\is-N9OSR.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

MobilewitchAcPro.tmp

Path \Users\Admin\AppData\Local\Temp\is-SCOM3.tmp\MobilewitchAcPro.tmp
Size 687KB
SHA256 14dfeee6e4f2f00e50d1d877deebcfc03889cc65e55ed7d81ebe5e7899063d3a
MD5 c29cf839d2771460775f29a0704650e4
SHA1 af61dbd2a46671ef36816c1fdfcba721ce6738a6
SHA512 643e9e2a3c580516ecb61b9a6790ce2746158f565ada547f8de25a92ca213d9fd4980902e46227c265a17e69a8be1dacc33bff28e2f2c6bfc18f7ddf3adeaf30
SSDEEP 12288:gRObekMtkfohrPUs37uzHnA6zg5cIsalHERjUrNN/RQ9wgUT5HDEx9eb:KObekYkfohrP337uzHnA6cHswHE/6gUJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2932-1-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2932-19-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3012-8-0x00000000001D0000-0x00000000001D1000-memory.dmp

Download

memory/3012-20-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3012-21-0x000000006B700000-0x000000006B72B000-memory.dmp

Download

memory/3012-25-0x00000000001D0000-0x00000000001D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads