1d19ba7c59b6efa5253ad59f3a707c7c1689af29ab760bc858f51b59dd3f077a

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IconCoolEditorV5.10_XiaoSD.exe
Size

4.7MB
MD5

a64a80c47559e0a678404213c555b542
SHA1

69affa051c73b3b4bd637e69de202d6633d09847
SHA256

39d7f73af1bc8a88fed8f0388ca26404d70584738e99c33ecffb3ae151808a0d
SHA512

38614b0e1011a03733f3572c4ceecac4af8ce68120158953b160642f5092da7ab94108726f82f0049134139571c788cd6bd45f9fdca688d4ccc288b9c3bd939c
SSDEEP

98304:wd8Qb8UYnA8XdHB9NVCsG9XzpP2UKqBeBI9rhyu+GerN1kSJVfQEhhYn1GGgE:w8aylH9M98EeyhhyzGiNuaQcYn19

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2968	is-2TRVT.tmp

Loads dropped DLL 3 IoCs

pid	Process
2524	IconCoolEditorV5.10_XiaoSD.exe
2968	is-2TRVT.tmp
2968	is-2TRVT.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2968	is-2TRVT.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2968	2524	IconCoolEditorV5.10_XiaoSD.exe	28
PID 2524 wrote to memory of 2968	2524	IconCoolEditorV5.10_XiaoSD.exe	28
PID 2524 wrote to memory of 2968	2524	IconCoolEditorV5.10_XiaoSD.exe	28
PID 2524 wrote to memory of 2968	2524	IconCoolEditorV5.10_XiaoSD.exe	28
PID 2524 wrote to memory of 2968	2524	IconCoolEditorV5.10_XiaoSD.exe	28
PID 2524 wrote to memory of 2968	2524	IconCoolEditorV5.10_XiaoSD.exe	28
PID 2524 wrote to memory of 2968	2524	IconCoolEditorV5.10_XiaoSD.exe	28

C:\Users\Admin\AppData\Local\Temp\IconCoolEditorV5.10_XiaoSD.exe
"C:\Users\Admin\AppData\Local\Temp\IconCoolEditorV5.10_XiaoSD.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\is-TI4HM.tmp\is-2TRVT.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TI4HM.tmp\is-2TRVT.tmp" /SL4 $4010A "C:\Users\Admin\AppData\Local\Temp\IconCoolEditorV5.10_XiaoSD.exe" 4675591 52224
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-Q6SOS.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-TI4HM.tmp\is-2TRVT.tmp

Filesize
635KB

MD5
935bc16ec2e483a47f485227303c9282

SHA1
e9fd30d7c8f93dc86fb62d0b5dadaa89477109f4

SHA256
9331ae3847ead3d91037d173ecf019aa2ff2c66685363fffc54b26707e4039d7

SHA512
375cc329b1ee83d7438a3f5592af9cd169dec8b1b77dc52957138f1802fdfcc928d0f33155e8d767eb7049ad210743ce258b980f171ca5dc05fb16e5d7aa82fe

Download Submit
memory/2524-1-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2524-15-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2968-16-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download