Overview

overview

7

Static

static

3

dc791ca65c...2e.exe

windows7-x64

7

dc791ca65c...2e.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    09-04-2024 15:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dc791ca65c079a5c817d717f3935bb57e960294f2199ea7e5f6b75a477df792e.exe

  • Size

    15.4MB

  • MD5

    546d52168d730f9e73c5ec2ad736d72e

  • SHA1

    0d05b40db5e023a6d77aaf28c3507bcec2a52fd7

  • SHA256

    dc791ca65c079a5c817d717f3935bb57e960294f2199ea7e5f6b75a477df792e

  • SHA512

    5def168dbd627773cff9d079d0a24a49c1a3a81c16de1537af0cd0f9befb83d44eb27280f0a5cf0106f1d564388cfa564e081feeca8930697e0fb339e5294247

  • SSDEEP

    393216:Y0dyfU0fkZpm+9hNN4fSCkKISCAyTkXfLH+LtKmgipYFJ:Y0dwf8pmK/GISSTkjH+LtKXipYz

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 12 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 60 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc791ca65c079a5c817d717f3935bb57e960294f2199ea7e5f6b75a477df792e.exe
    "C:\Users\Admin\AppData\Local\Temp\dc791ca65c079a5c817d717f3935bb57e960294f2199ea7e5f6b75a477df792e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2464
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\rename_expert-setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\rename_expert-setup.exe" /silent
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Users\Admin\AppData\Local\Temp\is-7M89L.tmp\rename_expert-setup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-7M89L.tmp\rename_expert-setup.tmp" /SL5="$3017C,11018677,780800,C:\Users\Admin\AppData\Local\Temp\RarSFX0\rename_expert-setup.exe" /silent
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2588
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\DebenuPDFLibraryLite1011.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1316
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe
    Filesize

    4.2MB

    MD5

    4a0a1e73b0b6eec9c409aba80603f775

    SHA1

    5be1d161a7034a0fb27c1f27d59339ff351b8ba5

    SHA256

    8be1234036700ba798eb15e3793f54773cda4efd214ff0e112e9fcf3b48167c3

    SHA512

    c8f0156c3d8ceddc0ac9c276085f24859cba8fb2726385757e15eda55396830b34774bd1baf399fad11097a28ea4cfd7d5a3030ef1c669ff659303ec8b7da4b3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-7M89L.tmp\rename_expert-setup.tmp
    Filesize

    2.9MB

    MD5

    58c9cfcedf42934c891b05ae74dfbbc7

    SHA1

    64e99cdf1bd062f059a2fd53802997755b4fa7a0

    SHA256

    f53216920e583280340716e59e7ed0182854fb6866a051832c06dbfeb042d873

    SHA512

    b247decbbc22b0288711d58766e5c1b6071e4fbdbdb2636b9a73591494a12c1e1caba8055bdc9c7c67b22eb3e324b81c133ccb182921394ee4336b46da9841b1

    Download Submit

  • C:\Windows\SysWOW64\DebenuPDFLibraryLite1011.dll
    Filesize

    6.1MB

    MD5

    5b1cb610caf266684e70d6b8c16c176b

    SHA1

    f3ec7ef670a7f3b0e65a864c95351b65276c15f6

    SHA256

    ab82ab9772cb5169a55e368adca03897003a7759ce8a5b0d00da74ee96fd1b2c

    SHA512

    f3f0ff6cfb72846c23469f7216261713fc67b0401dcb848b6db14ae460b404d12a4e8c0b628feb4856300575f9ee63d06b0aa2d4b17bffd8fa7cb39d8bc9915b

    Download Submit

  • \Program Files (x86)\Rename Expert\Rename_Expert.exe
    Filesize

    12.9MB

    MD5

    15a0b5e58b1e5fcaef637875c594e5e4

    SHA1

    816fa6e4e979b27ee6beda2105fea48694155b25

    SHA256

    783dc4afef960850e8c3d2b3cdfac2ff450983b435a683df225c0ecfa5fbc199

    SHA512

    8e95d436bb2fec4fbd9183ce97a16d9b5b444f8c967bb2c5786f1e59425f804599d69b7e31e6963861284fb527797e3916b4e005234d9bfc1fb47778ec51f43b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\RarSFX0\rename_expert-setup.exe
    Filesize

    11.4MB

    MD5

    1696bd45406ec9a1136870f1256168d6

    SHA1

    b9f6ca0805ee227acf4a84fc5a8d57b61e54378b

    SHA256

    e97ace90e141de6b58b0a96e33fa6e42d645d5d723bd1fef285e0dfd57d903b2

    SHA512

    abc2d968a695ae7e67be076763546f2114f771d90483f2cb8132348efbe7069842fc84f5606d2dc87b73cf54a8daff71fc7ba12192159d7a4bec9e2643ceaf82

    Download Submit

  • memory/1316-187-0x0000000002320000-0x000000000294F000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/2068-21-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

    Download

  • memory/2068-24-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

    Download

  • memory/2068-192-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

    Download

  • memory/2588-30-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2588-191-0x0000000000400000-0x00000000006EE000-memory.dmp

    Filesize

    2.9MB

    Download