7590dc4238bbea73ddaea1695caee009fec69c87fac142d81d2fbb688d9a878a

Analysis

max time kernel
67s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_songs_of_syx_0.64.65_(64bit)_(70667).exe
Size

331.2MB
MD5

cf2a173822952fa9dec0496cbb5f989a
SHA1

6239e2617dd0c59acadeb416babffd2b07dd1860
SHA256

7590dc4238bbea73ddaea1695caee009fec69c87fac142d81d2fbb688d9a878a
SHA512

6a58d67057a9a4a6f167ac39ccc2bce10f6d44a425fa1718ae6aebe4d6ff4e5db6e80a85e5ca507938418892cac778181fb05e12bc6b898f42529aa53328f370
SSDEEP

6291456:JgeGeQs+MYA2/dH0p4r+iraf1/woqqGqUro4f1IPnwM0Nz2F08/3+R467kPKK5lX:6eG++9f1H0p4rze+zqGqUro+I4lV2Fb9

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
396	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp

Loads dropped DLL 6 IoCs

pid	Process
396	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
396	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
396	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
396	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
396	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
396	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 396	3400	setup_songs_of_syx_0.64.65_(64bit)_(70667).exe	88
PID 3400 wrote to memory of 396	3400	setup_songs_of_syx_0.64.65_(64bit)_(70667).exe	88
PID 3400 wrote to memory of 396	3400	setup_songs_of_syx_0.64.65_(64bit)_(70667).exe	88

C:\Users\Admin\AppData\Local\Temp\setup_songs_of_syx_0.64.65_(64bit)_(70667).exe
"C:\Users\Admin\AppData\Local\Temp\setup_songs_of_syx_0.64.65_(64bit)_(70667).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Users\Admin\AppData\Local\Temp\is-MR5MD.tmp\setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MR5MD.tmp\setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp" /SL5="$80180,346730687,192512,C:\Users\Admin\AppData\Local\Temp\setup_songs_of_syx_0.64.65_(64bit)_(70667).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\1447688349_english.jpg

Filesize
227KB

MD5
5c51377949dd79a4d23b0af2653a110c

SHA1
22e38dcdb27c68c43cdd7167b478f4c311c860c6

SHA256
ce802e86224ddc3c753bbf26fcf32c2e47a4085754036a0d79cc7a213b3ba3c2

SHA512
62476bafcf6bb40b80ef84dcb478f5a773b05f1fe51cb99f21940229ed2ca479a22e045a7e5cb643ea9e7a7921131f10d77a82157f9af19fe21e54c45971ddea

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\1449581489_english.jpg

Filesize
232KB

MD5
b84497f26c948992cc81f7f6163456a2

SHA1
7989c8be464bacde091f1f378b72c58f2a98448b

SHA256
438deb1778ea0b0205307959ac402767da060ec7f40284016d0e3be80f606118

SHA512
e98cf1327978465b4331a61eeadd4a3103c7922d65c776e97b7b4615a17ff2a345a6bf0c8cb8357c3a6d6aaa9fabd4f16f749aded776c29c16b77ef7181dd3e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\BigOK.png

Filesize
3KB

MD5
5b43a5d975a53f4fc1da67ce9f7784c1

SHA1
8543fa1e471030049942252b23cb22e0880c3af5

SHA256
59d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a

SHA512
5dd5c4e9859a555a4a32da76f5231b44f7556274c6501da530b2cdd570bcb4675f710bee708322a40ed3ef9280c0d652b4e7ef0e9eaf128c08534f59291917f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\EULAAccepted.png

Filesize
2KB

MD5
461dfeb75927bdb39f9db5348612a611

SHA1
b7893b1fff6801e37ee7337d876962a09184941e

SHA256
0de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c

SHA512
68528cf45c81c2c024a672f42c2cd6d4f72c015b443f103ca21deb8ee2bec4f4027490e7f33b5338a87537b5bf7f255f2828aed149f622155ec89cc81687651b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\EULAShow.png

Filesize
1KB

MD5
c596bc9111edc702bbbb29b70984254f

SHA1
d4712c7b91ff4f8994e7907d31357c42eb47c738

SHA256
6112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462

SHA512
db50d0a39ec644873a03d64552fff1776cc94f016e8dfc8918e65aee94f7529a6de4637567b5e65c4ea988f3775785c4b52c2d96fe8dbc52b1e21ff59c737c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\background.jpg

Filesize
578KB

MD5
b5c05d0dc9b862f53f7984c7195371f1

SHA1
2a14c16abeead25503325f3d933ff2f4f751fb44

SHA256
380c35a236f5f54058102bd612c6a8563b2c456dc06d061866f8cc4959f41b36

SHA512
016c611a0425ffaf4f5b9473ab6f9080612ff05aebeeb21022d322d39550c8df9703a3e986c1fead489f0ac0840225639acb304c170d28343d8df90ea2c55c0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\botva2.dll

Filesize
35KB

MD5
0177746573eed407f8dca8a9e441aa49

SHA1
6b462adf78059d26cbc56b3311e3b97fcb8d05f7

SHA256
a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

SHA512
d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\btn_md5.png

Filesize
8KB

MD5
3befe9739354ee24a0b1ea8df05ce274

SHA1
ab0bda986a8c46aa19f57b75a2b7b22445a3c625

SHA256
b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47

SHA512
ac016a59e0bfc9b22c376ae5d498c5660893a983d932b2bd502dabe032883c69e79ea8d93c2db49f95415c3cdb068e9f7d1d85527a4f9e68e065a989852d09dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\crcdll.dll

Filesize
69KB

MD5
1d51fac9e2384eeb674199cfd5281d7d

SHA1
861dfdc121357d605d0cc3793266713788109eb2

SHA256
23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec

SHA512
921b00adfe43b883200960e8d0958d4e6b97f6d5cfc096ee277766a3e44cc7805a20877a4edf8bd4d9102bb71a20ac218a9a512f4f76bd751d3ef14f4e0a6eda

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\error.png

Filesize
726B

MD5
df10adc25b673e74e19971c17bee5a98

SHA1
ee16fb1cf9491f5e611282f0574b27d76fede412

SHA256
142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b

SHA512
dc3de10e0321966cbbfb2e57b3b41da6f26dff0c7233a47469da58775b5c471e6b5181e4d4ffc81ef8b83dbcad74ccc1aad7678518f99c9185a441d2a23e010f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\ok.png

Filesize
1KB

MD5
103c1368e60806b1b7995a0894eacf87

SHA1
971392527f6e4b655044773132505c901a6b5469

SHA256
0d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e

SHA512
652177e94438aff102f2ed873b26f0985ebed134763852b49b1ca2698463c1dbeb85152f19c8e18d397229ec5cb2cd1d17c61d454ab7c425a2cab540adc8228a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\slideshow.ini

Filesize
278B

MD5
81762158073c1d9dbc4cb777cb7ef1e4

SHA1
800e424ae556f8697d87147703a4ec2ac28179fa

SHA256
40d7fdde0c7c5c420403d9f057f8a55928524ecfe36430dcb05223a42f4c7766

SHA512
34d649851157671bc57d09dcd36b4d2a5d64ee53c9f42c63170199c88149f24a152901e668b7ab3f26f381614eb788138e4c8096bf75c6faba2e70f91d7406de

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C6TLM.tmp\uninstall.dll

Filesize
691KB

MD5
7db706c324cc9b6fda497d081eed6e26

SHA1
ca97392e573af0cf61bfa3301801a85f2beea44c

SHA256
cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0

SHA512
8edf1494d57d5e708faaff4170f21f435658be897a6fe0acf243ced0701a7fd574b3c973c5bc5e8d92815e966c98977e69ac1e3083ab00c11b072115527ffa19

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MR5MD.tmp\setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp

Filesize
1.3MB

MD5
ff5ebf66cddd9913b729de78eeb638c8

SHA1
ca23d5639d1c516e3defc8f5b267bb5c040238d5

SHA256
abf8d4d522ca94a179d644ec0464474b580ec82441b118b663da3bd879f91d85

SHA512
4fa3a2dc8ad68bfffc0e039171d2da71c3c37eade709d5495e825bb53f576180eafee57e3c1f78d7dcc8d26e26cc24e1e99bb494d9b4a55f74f4145eb6e5a05b

Download Submit
memory/396-139-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/396-138-0x0000000000E50000-0x0000000000FA2000-memory.dmp

Filesize
1.3MB

Download
memory/396-150-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/396-15-0x00000000035B0000-0x0000000003667000-memory.dmp

Filesize
732KB

Download
memory/396-152-0x0000000003670000-0x000000000367E000-memory.dmp

Filesize
56KB

Download
memory/396-136-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Filesize
4KB

Download
memory/396-147-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/396-60-0x0000000003670000-0x000000000367E000-memory.dmp

Filesize
56KB

Download
memory/396-141-0x0000000003670000-0x000000000367E000-memory.dmp

Filesize
56KB

Download
memory/396-140-0x00000000035B0000-0x0000000003667000-memory.dmp

Filesize
732KB

Download
memory/396-6-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/3400-137-0x00000000006E0000-0x0000000000719000-memory.dmp

Filesize
228KB

Download
memory/3400-2-0x00000000006E0000-0x0000000000719000-memory.dmp

Filesize
228KB

Download
memory/3400-0-0x00000000006E0000-0x0000000000719000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads