1d19ba7c59b6efa5253ad59f3a707c7c1689af29ab760bc858f51b59dd3f077a

Analysis

max time kernel
141s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IconCoolEditorV5.10_XiaoSD.exe
Size

4.7MB
MD5

a64a80c47559e0a678404213c555b542
SHA1

69affa051c73b3b4bd637e69de202d6633d09847
SHA256

39d7f73af1bc8a88fed8f0388ca26404d70584738e99c33ecffb3ae151808a0d
SHA512

38614b0e1011a03733f3572c4ceecac4af8ce68120158953b160642f5092da7ab94108726f82f0049134139571c788cd6bd45f9fdca688d4ccc288b9c3bd939c
SSDEEP

98304:wd8Qb8UYnA8XdHB9NVCsG9XzpP2UKqBeBI9rhyu+GerN1kSJVfQEhhYn1GGgE:w8aylH9M98EeyhhyzGiNuaQcYn19

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3660	is-R6RL3.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 3660	1420	IconCoolEditorV5.10_XiaoSD.exe	85
PID 1420 wrote to memory of 3660	1420	IconCoolEditorV5.10_XiaoSD.exe	85
PID 1420 wrote to memory of 3660	1420	IconCoolEditorV5.10_XiaoSD.exe	85

C:\Users\Admin\AppData\Local\Temp\IconCoolEditorV5.10_XiaoSD.exe
"C:\Users\Admin\AppData\Local\Temp\IconCoolEditorV5.10_XiaoSD.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Users\Admin\AppData\Local\Temp\is-IAFMR.tmp\is-R6RL3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IAFMR.tmp\is-R6RL3.tmp" /SL4 $90068 "C:\Users\Admin\AppData\Local\Temp\IconCoolEditorV5.10_XiaoSD.exe" 4675591 52224
  2⤵
  - Executes dropped EXE
  PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-IAFMR.tmp\is-R6RL3.tmp

Filesize
635KB

MD5
935bc16ec2e483a47f485227303c9282

SHA1
e9fd30d7c8f93dc86fb62d0b5dadaa89477109f4

SHA256
9331ae3847ead3d91037d173ecf019aa2ff2c66685363fffc54b26707e4039d7

SHA512
375cc329b1ee83d7438a3f5592af9cd169dec8b1b77dc52957138f1802fdfcc928d0f33155e8d767eb7049ad210743ce258b980f171ca5dc05fb16e5d7aa82fe

Download Submit
memory/1420-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1420-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1420-12-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3660-9-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/3660-13-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3660-16-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download