8863f887505fb33aa29b652cb3f84999c63da172d917b96ea7958a869d508506

Resubmissions

23/03/2024, 20:50

240323-zmtl5aeg7z10

23/03/2024, 01:09

240323-bh4drsbd5610

22/03/2024, 21:56

240322-1tr8baca3v10

22/03/2024, 02:58

240322-dglhnsff4910

Analysis

max time kernel
122s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/03/2024, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size 13KB
Sample240322-dglhnsff49
SHA256 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
MD5 da0f40d84d72ae3e9324ad9a040a2e58
SHA1 4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA512 30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP 384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2432	screenCapture_1.3.2.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2536	csc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2536	2388	cmd.exe	30
PID 2388 wrote to memory of 2536	2388	cmd.exe	30
PID 2388 wrote to memory of 2536	2388	cmd.exe	30
PID 2388 wrote to memory of 2536	2388	cmd.exe	30
PID 2536 wrote to memory of 2376	2536	csc.exe	31
PID 2536 wrote to memory of 2376	2536	csc.exe	31
PID 2536 wrote to memory of 2376	2536	csc.exe	31
PID 2536 wrote to memory of 2376	2536	csc.exe	31
PID 2388 wrote to memory of 2432	2388	cmd.exe	32
PID 2388 wrote to memory of 2432	2388	cmd.exe	32
PID 2388 wrote to memory of 2432	2388	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2B64.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC7204AF746E4E4197A08E1E61D17E3.TMP"
    3⤵
    PID:2376
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES2B64.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2B64.tmp
Size 1KB
SHA256 8068bf5b921553c98c025dbcbc7747e6ed617e59e8ec7a1d58772ba3256e63c7
MD5 ad07fd8ab0552ccf2082ca623ed411f3
SHA1 9efcf06a0bfe834b82b1655cc3b9e80f8e5a1e70
SHA512 cf58614bdbe4bf0b3e05f744b4a56ef87536461130238c73c252b70cc3adf7b691ce51e878c845c971e87b2179e553cd6279bc4cb5cc44dc95fa082457eb72af
MD5 SHA1 SHA512

Submit Download

screenCapture_1.3.2.exe

Path C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
Size 12KB
SHA256 085265931a95e14877c92a20653b8dd080ed642c4ada255457c8b0e862c2344f
MD5 be1512dfbbf9bd4320a6dd7ebde2b637
SHA1 3ceaf8c0562e64c5ea8f6a27307ba002b8eb3b4f
SHA512 59dd6e5b432bd43f2791bcad754550ce69b94b2872f666d7b7a844f0d8044edaeb64aeedfd3737e32ccf9d46d9ebfc59ed2ae4c2d31884bc98e310992a37f85b
SSDEEP 192:0+0ZP9yjWewKlBNOOOP3fs3JBy775ia7SBgvuIbZa8uXZlLpwHdGJpRT/:oiW6OOOPUy75i/++XZ1pwHdGJ7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC7204AF746E4E4197A08E1E61D17E3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC7204AF746E4E4197A08E1E61D17E3.TMP
Size 1KB
SHA256 ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344
MD5 a6f2d21624678f54a2abed46e9f3ab17
SHA1 a2a6f07684c79719007d434cbd1cd2164565734a
SHA512 0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676
MD5 SHA1 SHA512

Submit Download

memory/2432-8-0x00000000008D0000-0x00000000008DA000-memory.dmp

Download

memory/2432-9-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Download

memory/2432-10-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads