f40b1402c66949c0f502d21425b0778e079b3419c8bbaae387fb952818289baa

General

Target

f40b1402c66949c0f502d21425b0778e079b3419c8bbaae387fb952818289baa.exe
Size

427KB
MD5

4138bddd9501f936cf56e482441d5705
SHA1

b1a5555f1e378771ff8a3d5422d5f08098c9b9dd
SHA256

f40b1402c66949c0f502d21425b0778e079b3419c8bbaae387fb952818289baa
SHA512

b7f2f6219b0e3130b62f812771e845eab15d520b3100e9985fd4f863768d3a42ca175752b480f02abaf235d51e64e56be8169a2922ade55de4f3ea8f271be43e
SSDEEP

3072:TjtwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOylqwvtexB3no2Wq:Fuj8NDF3OR9/Qe2HdJf+3oo

Score

9^/10

Malware Config

Signatures

Detects executables packed with ASPack 4 IoCs

resource	yara_rule
behavioral1/files/0x000700000001211e-3.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1732-12-0x0000000000400000-0x0000000000425000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1928-13-0x0000000000400000-0x0000000000425000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x003100000001313a-17.dat	INDICATOR_EXE_Packed_ASPack

Deletes itself 1 IoCs

pid	Process
2608	Casino_ext.exe

Executes dropped EXE 4 IoCs

pid	Process
1928	casino_extensions.exe
2316	Casino_ext.exe
2664	casino_extensions.exe
2608	Casino_ext.exe

Loads dropped DLL 4 IoCs

pid	Process
2088	casino_extensions.exe
2088	casino_extensions.exe
2600	casino_extensions.exe
2600	casino_extensions.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2316	Casino_ext.exe
2608	Casino_ext.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1732	f40b1402c66949c0f502d21425b0778e079b3419c8bbaae387fb952818289baa.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2088	1732	f40b1402c66949c0f502d21425b0778e079b3419c8bbaae387fb952818289baa.exe	28
PID 1732 wrote to memory of 2088	1732	f40b1402c66949c0f502d21425b0778e079b3419c8bbaae387fb952818289baa.exe	28
PID 1732 wrote to memory of 2088	1732	f40b1402c66949c0f502d21425b0778e079b3419c8bbaae387fb952818289baa.exe	28
PID 1732 wrote to memory of 2088	1732	f40b1402c66949c0f502d21425b0778e079b3419c8bbaae387fb952818289baa.exe	28
PID 2088 wrote to memory of 1928	2088	casino_extensions.exe	29
PID 2088 wrote to memory of 1928	2088	casino_extensions.exe	29
PID 2088 wrote to memory of 1928	2088	casino_extensions.exe	29
PID 2088 wrote to memory of 1928	2088	casino_extensions.exe	29
PID 1928 wrote to memory of 2316	1928	casino_extensions.exe	30
PID 1928 wrote to memory of 2316	1928	casino_extensions.exe	30
PID 1928 wrote to memory of 2316	1928	casino_extensions.exe	30
PID 1928 wrote to memory of 2316	1928	casino_extensions.exe	30
PID 2316 wrote to memory of 2600	2316	Casino_ext.exe	31
PID 2316 wrote to memory of 2600	2316	Casino_ext.exe	31
PID 2316 wrote to memory of 2600	2316	Casino_ext.exe	31
PID 2316 wrote to memory of 2600	2316	Casino_ext.exe	31
PID 2600 wrote to memory of 2664	2600	casino_extensions.exe	32
PID 2600 wrote to memory of 2664	2600	casino_extensions.exe	32
PID 2600 wrote to memory of 2664	2600	casino_extensions.exe	32
PID 2600 wrote to memory of 2664	2600	casino_extensions.exe	32
PID 2664 wrote to memory of 2608	2664	casino_extensions.exe	33
PID 2664 wrote to memory of 2608	2664	casino_extensions.exe	33
PID 2664 wrote to memory of 2608	2664	casino_extensions.exe	33
PID 2664 wrote to memory of 2608	2664	casino_extensions.exe	33

C:\Users\Admin\AppData\Local\Temp\f40b1402c66949c0f502d21425b0778e079b3419c8bbaae387fb952818289baa.exe
"C:\Users\Admin\AppData\Local\Temp\f40b1402c66949c0f502d21425b0778e079b3419c8bbaae387fb952818289baa.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\casino_extensions.exe
    C:\Windows\system32\casino_extensions.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\SysWOW64\Casino_ext.exe
      C:\Windows\SysWOW64\Casino_ext.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2316
    - - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        5⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2600
      - C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        7⤵
        Deletes itself
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\casino_extensions.exe

Filesize
444KB

MD5
5655a376e7567275666214c4304782e6

SHA1
81fbb869f1e58e6c622f89e26e7b9c81723d8a9f

SHA256
f1c160425ea2cccd81ec49339317f46fffdcb75ae8f375268ce25fbb03e7b30c

SHA512
44f9e3ee80364db2dbdf77b2cf384ba4c6752cb32790b691411fdc46646933f0984873308b9b2193fcff2bcfd36322ee1e395d13beda2dc1b000a75a5852b0bd

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
432KB

MD5
73343cfade61874084c2eecba9cb9913

SHA1
24d1948772dddfff8cbd93f4e6be97d3c6ac9439

SHA256
e3fbe9362c68d9d95529bca8c39bf820db88c58961d8faf79fd43168be2c4599

SHA512
8a35404b32ee8c9003c9ffbe7e6ae7ae1f2071fb22f95a6a4ae6177fd97000e5faa576eeb5772ec7f5f57ba437ef82423212ac9391d928aeaca18bbbea977869

Download Submit
memory/1732-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1928-13-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing