60db89f38626cc32b4592a6f261428175b63db954c9cf91b1ab677336a63a104

General

Target

60db89f38626cc32b4592a6f261428175b63db954c9cf91b1ab677336a63a104.exe
Size

979KB
MD5

79497e6810e40eac25716164ce78d221
SHA1

381bceb264813368a6482e9090a3b8f73e684b9b
SHA256

60db89f38626cc32b4592a6f261428175b63db954c9cf91b1ab677336a63a104
SHA512

e9643240ffcffbc1ae10cc9c3db14b8d73a0287e9ad50568ce7b988769bd3f89a0086039f54654f9e5ec38bdcd1390249edd4e16c6ec36433c6321ad90471a9b
SSDEEP

3072:mtwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOylqwMykw+imi5wxx4Vao2i1dm:6uj8NDF3OR9/Qe2HdJ8pS4ofWdii6Qr/

Score

9^/10

Malware Config

Signatures

Detects executables packed with ASPack 4 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012286-3.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1252-13-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1424-12-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0031000000015d12-17.dat	INDICATOR_EXE_Packed_ASPack

Deletes itself 1 IoCs

pid	Process
2776	Casino_ext.exe

Executes dropped EXE 4 IoCs

pid	Process
1424	casino_extensions.exe
2972	Casino_ext.exe
2004	casino_extensions.exe
2776	Casino_ext.exe

Loads dropped DLL 4 IoCs

pid	Process
2060	casino_extensions.exe
2060	casino_extensions.exe
2384	casino_extensions.exe
2384	casino_extensions.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	Casino_ext.exe
2776	Casino_ext.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1252	60db89f38626cc32b4592a6f261428175b63db954c9cf91b1ab677336a63a104.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2060	1252	60db89f38626cc32b4592a6f261428175b63db954c9cf91b1ab677336a63a104.exe	28
PID 1252 wrote to memory of 2060	1252	60db89f38626cc32b4592a6f261428175b63db954c9cf91b1ab677336a63a104.exe	28
PID 1252 wrote to memory of 2060	1252	60db89f38626cc32b4592a6f261428175b63db954c9cf91b1ab677336a63a104.exe	28
PID 1252 wrote to memory of 2060	1252	60db89f38626cc32b4592a6f261428175b63db954c9cf91b1ab677336a63a104.exe	28
PID 2060 wrote to memory of 1424	2060	casino_extensions.exe	29
PID 2060 wrote to memory of 1424	2060	casino_extensions.exe	29
PID 2060 wrote to memory of 1424	2060	casino_extensions.exe	29
PID 2060 wrote to memory of 1424	2060	casino_extensions.exe	29
PID 1424 wrote to memory of 2972	1424	casino_extensions.exe	30
PID 1424 wrote to memory of 2972	1424	casino_extensions.exe	30
PID 1424 wrote to memory of 2972	1424	casino_extensions.exe	30
PID 1424 wrote to memory of 2972	1424	casino_extensions.exe	30
PID 2972 wrote to memory of 2384	2972	Casino_ext.exe	31
PID 2972 wrote to memory of 2384	2972	Casino_ext.exe	31
PID 2972 wrote to memory of 2384	2972	Casino_ext.exe	31
PID 2972 wrote to memory of 2384	2972	Casino_ext.exe	31
PID 2384 wrote to memory of 2004	2384	casino_extensions.exe	32
PID 2384 wrote to memory of 2004	2384	casino_extensions.exe	32
PID 2384 wrote to memory of 2004	2384	casino_extensions.exe	32
PID 2384 wrote to memory of 2004	2384	casino_extensions.exe	32
PID 2004 wrote to memory of 2776	2004	casino_extensions.exe	33
PID 2004 wrote to memory of 2776	2004	casino_extensions.exe	33
PID 2004 wrote to memory of 2776	2004	casino_extensions.exe	33
PID 2004 wrote to memory of 2776	2004	casino_extensions.exe	33

C:\Users\Admin\AppData\Local\Temp\60db89f38626cc32b4592a6f261428175b63db954c9cf91b1ab677336a63a104.exe
"C:\Users\Admin\AppData\Local\Temp\60db89f38626cc32b4592a6f261428175b63db954c9cf91b1ab677336a63a104.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\casino_extensions.exe
    C:\Windows\system32\casino_extensions.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Windows\SysWOW64\Casino_ext.exe
      C:\Windows\SysWOW64\Casino_ext.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2972
    - - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        5⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2384
      - C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        7⤵
        Deletes itself
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\casino_extensions.exe

Filesize
995KB

MD5
0e0bd8d5b2dd07e0a86b196116868867

SHA1
27ad843c14b4b4481582204a7e68bca6b7b59182

SHA256
150bbffcda4b903eb425ac0fc66a79c8b7b1dd858b475e955e672533961abb10

SHA512
b9813676d6d8a9874e3a4d19dc2e4fdb98521972c89f02e34fedfc3b2544b4dee79cce3b97e3cda8ed3e8a3df84317256e48eaa1bea2bd64c4bed1d163c1a0f1

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
982KB

MD5
cc02d8bd93a567c3e4e4f139df8f7165

SHA1
c180e35743fb709385a78951d63728b026077140

SHA256
07c18e106fde652bf795c92254f7cf1ca78fdb98770a9de55fad627f1bd906b4

SHA512
6cc9a93e8320d92a360a50a7cf37d985d07e3b4f46896c2bbf68b6c89493693963a3639bd28acd2a55a68c7a654b5ee677cd750775d2061e63065b72f6a1201c

Download Submit
memory/1252-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1424-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing