bbae641cfeb6467f9400254909f7d312d5f31f936cdc08bc723b7f1555d97c62

General

Target

bbae641cfeb6467f9400254909f7d312d5f31f936cdc08bc723b7f1555d97c62.exe
Size

965KB
MD5

a4b017d33ab1777d4e2ae72061391bd5
SHA1

7f3f18dc8f9b636d91e27955b7af03ff776bae94
SHA256

bbae641cfeb6467f9400254909f7d312d5f31f936cdc08bc723b7f1555d97c62
SHA512

21e83758d1b8fa7f9c8862f88bb4be5f48fcb7879f3901edc8ab63d3702efc244b745547084714eb2171535fcf057990c270dd2ac03d8a8f0e3423b6c130e07f
SSDEEP

6144:Zuj8NDF3OR9/Qe2HdklrSqjzQtJnjqno2k29eLG:4OF3ORK3d9QzQtJnjqno2k29H

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2708	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
820	casino_extensions.exe
2720	LiveMessageCenter.exe

Loads dropped DLL 4 IoCs

pid	Process
2792	casino_extensions.exe
2792	casino_extensions.exe
2112	casino_extensions.exe
2112	casino_extensions.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	LiveMessageCenter.exe
File created	C:\Program Files (x86)\Internet Explorer\$$202803s.bat	casino_extensions.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2720	LiveMessageCenter.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2036	bbae641cfeb6467f9400254909f7d312d5f31f936cdc08bc723b7f1555d97c62.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2792	2036	bbae641cfeb6467f9400254909f7d312d5f31f936cdc08bc723b7f1555d97c62.exe	28
PID 2036 wrote to memory of 2792	2036	bbae641cfeb6467f9400254909f7d312d5f31f936cdc08bc723b7f1555d97c62.exe	28
PID 2036 wrote to memory of 2792	2036	bbae641cfeb6467f9400254909f7d312d5f31f936cdc08bc723b7f1555d97c62.exe	28
PID 2036 wrote to memory of 2792	2036	bbae641cfeb6467f9400254909f7d312d5f31f936cdc08bc723b7f1555d97c62.exe	28
PID 2792 wrote to memory of 820	2792	casino_extensions.exe	29
PID 2792 wrote to memory of 820	2792	casino_extensions.exe	29
PID 2792 wrote to memory of 820	2792	casino_extensions.exe	29
PID 2792 wrote to memory of 820	2792	casino_extensions.exe	29
PID 820 wrote to memory of 2112	820	casino_extensions.exe	30
PID 820 wrote to memory of 2112	820	casino_extensions.exe	30
PID 820 wrote to memory of 2112	820	casino_extensions.exe	30
PID 820 wrote to memory of 2112	820	casino_extensions.exe	30
PID 2112 wrote to memory of 2720	2112	casino_extensions.exe	31
PID 2112 wrote to memory of 2720	2112	casino_extensions.exe	31
PID 2112 wrote to memory of 2720	2112	casino_extensions.exe	31
PID 2112 wrote to memory of 2720	2112	casino_extensions.exe	31
PID 2720 wrote to memory of 2648	2720	LiveMessageCenter.exe	32
PID 2720 wrote to memory of 2648	2720	LiveMessageCenter.exe	32
PID 2720 wrote to memory of 2648	2720	LiveMessageCenter.exe	32
PID 2720 wrote to memory of 2648	2720	LiveMessageCenter.exe	32
PID 2648 wrote to memory of 2708	2648	casino_extensions.exe	33
PID 2648 wrote to memory of 2708	2648	casino_extensions.exe	33
PID 2648 wrote to memory of 2708	2648	casino_extensions.exe	33
PID 2648 wrote to memory of 2708	2648	casino_extensions.exe	33

C:\Users\Admin\AppData\Local\Temp\bbae641cfeb6467f9400254909f7d312d5f31f936cdc08bc723b7f1555d97c62.exe
"C:\Users\Admin\AppData\Local\Temp\bbae641cfeb6467f9400254909f7d312d5f31f936cdc08bc723b7f1555d97c62.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\casino_extensions.exe
    C:\Windows\system32\casino_extensions.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
      "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
      4⤵
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2112
    - - C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe /part2
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2720
      - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        6⤵
        Drops file in System32 directory
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c $$2028~1.BAT
        7⤵
        Deletes itself
        
        PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\$$202803s.bat

Filesize
81B

MD5
4777bf695815d870d27ed4a38a8f0840

SHA1
565412b5182bca7a221448dba78369c42d1c4a0c

SHA256
c08018226d9a45ab277a01ca35f519ff7ea1cb450d080e24b0f590739654241d

SHA512
87e792d326c5a9d2d92984ec4c34d2af9d616a4676a7d69df73b09975fd077d96077ae2528b6fc05752110eb4e406c3e9d94d49d0a74eeaba6bc6a48bca8ac1d

Download Submit
\Windows\SysWOW64\LiveMessageCenter.exe

Filesize
976KB

MD5
7d0111f222d11fc617ba92c47aa9f843

SHA1
f8b081ee30a49ac2d9ce60d08d7077b45f5455bc

SHA256
b70e08b28c793cfd7893756da7a4252c51fead716d2d82440f80c757d8c92852

SHA512
244047397b51ff42dfe0111748614a8292973d0693bd7450fb8310f04b496acfcf706bfc93ed37db02806f93fafd778ce0a88b52525d5b9aec43003d16630777

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
970KB

MD5
9dd96a807d90971fa1b26e95e52270d5

SHA1
f7ccef6d4b1fffc015a08f5f8a9f00433aceba0e

SHA256
49231e8743fe7bf870e12f3eec71b00aac00cb9d5ba67ff3a98a0697cc82b7b5

SHA512
8bb95a0e8cded801dc57c64b4bfde25dcc588c1ab1d9fb1a7d527df8fb896ed1f23abaa224c006e4e00ebf3a3bebd583b9dc80589b3a7c9e123cf63aa305e558

Download Submit
memory/2036-20-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing