Analysis
-
max time kernel
33s -
max time network
19s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
21/05/2024, 20:39
Behavioral task
behavioral1
Sample
PolarCrasher.exe
Resource
win11-20240508-en
General
-
Target
PolarCrasher.exe
-
Size
11.6MB
-
MD5
40dbe831926689e4d37f221b3e9ed135
-
SHA1
50534117514922765b74ee80c59af1581d2c5d2b
-
SHA256
0993ad20decfd8a1334035bf9062a70a808787b330908dc035feb04177b836d5
-
SHA512
c8e9867394f79e83dab70b9d50cf1de5235e14c48105c2e9b59a70b4bd202e72b8a14c7ac1d82f03677bd7358ddff5e7148c1db75bdbf81a1acb01f00e1b634d
-
SSDEEP
196608:PsGsRrjk0p1W903eV4QRIMToEuGxgh858F0ibfU9au5p0W8/LQhoANNngABSbknL:JG00vW+eGQRIMTozGxu8C0ibfEau5qWb
Malware Config
Signatures
-
Loads dropped DLL 30 IoCs
pid Process 5116 PolarCrasher.exe 5116 PolarCrasher.exe 5116 PolarCrasher.exe 5116 PolarCrasher.exe 5116 PolarCrasher.exe 5116 PolarCrasher.exe 5116 PolarCrasher.exe 5116 PolarCrasher.exe 5116 PolarCrasher.exe 5116 PolarCrasher.exe 3604 PolarCrasher.exe 3604 PolarCrasher.exe 3604 PolarCrasher.exe 3604 PolarCrasher.exe 3604 PolarCrasher.exe 3604 PolarCrasher.exe 3604 PolarCrasher.exe 3604 PolarCrasher.exe 3604 PolarCrasher.exe 3604 PolarCrasher.exe 7012 PolarCrasher.exe 7012 PolarCrasher.exe 7012 PolarCrasher.exe 7012 PolarCrasher.exe 7012 PolarCrasher.exe 7012 PolarCrasher.exe 7012 PolarCrasher.exe 7012 PolarCrasher.exe 7012 PolarCrasher.exe 7012 PolarCrasher.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4952 wrote to memory of 5116 4952 PolarCrasher.exe 78 PID 4952 wrote to memory of 5116 4952 PolarCrasher.exe 78 PID 6064 wrote to memory of 3604 6064 PolarCrasher.exe 84 PID 6064 wrote to memory of 3604 6064 PolarCrasher.exe 84 PID 7044 wrote to memory of 7012 7044 PolarCrasher.exe 87 PID 7044 wrote to memory of 7012 7044 PolarCrasher.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\PolarCrasher.exe"C:\Users\Admin\AppData\Local\Temp\PolarCrasher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\PolarCrasher.exe"C:\Users\Admin\AppData\Local\Temp\PolarCrasher.exe"2⤵
- Loads dropped DLL
PID:5116
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\PolarCrasher.exe"C:\Users\Admin\AppData\Local\Temp\PolarCrasher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\PolarCrasher.exe"C:\Users\Admin\AppData\Local\Temp\PolarCrasher.exe"2⤵
- Loads dropped DLL
PID:3604
-
-
C:\Users\Admin\AppData\Local\Temp\PolarCrasher.exe"C:\Users\Admin\AppData\Local\Temp\PolarCrasher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:7044 -
C:\Users\Admin\AppData\Local\Temp\PolarCrasher.exe"C:\Users\Admin\AppData\Local\Temp\PolarCrasher.exe"2⤵
- Loads dropped DLL
PID:7012
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
82KB
MD590f58f625a6655f80c35532a087a0319
SHA1d4a7834201bd796dc786b0eb923f8ec5d60f719b
SHA256bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946
SHA512b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8
-
Filesize
122KB
MD5452305c8c5fda12f082834c3120db10a
SHA19bab7b3fd85b3c0f2bedc3c5adb68b2579daa6e7
SHA256543ce9d6dc3693362271a2c6e7d7fc07ad75327e0b0322301dd29886467b0b0e
SHA5123d52afdbc8da74262475abc8f81415a0c368be70dbf5b2bd87c9c29ca3d14c44770a5b8b2e7c082f3ece0fd2ba1f98348a04b106a48d479fa6bd062712be8f7c
-
Filesize
247KB
MD5f78f9855d2a7ca940b6be51d68b80bf2
SHA1fd8af3dbd7b0ea3de2274517c74186cb7cd81a05
SHA256d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12
SHA5126b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18
-
Filesize
64KB
MD58baeb2bd6e52ba38f445ef71ef43a6b8
SHA14132f9cd06343ef8b5b60dc8a62be049aa3270c2
SHA2566c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087
SHA512804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65
-
Filesize
155KB
MD5cf8de1137f36141afd9ff7c52a3264ee
SHA1afde95a1d7a545d913387624ef48c60f23cf4a3f
SHA25622d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16
SHA512821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f
-
Filesize
31KB
MD55aa4b057ba2331eed6b4b30f4b3e0d52
SHA16b9db113c2882743984c3d8b70ec49fc4a136c23
SHA256d43dca0e00c3c11329b68177e967cf5240495c4786f5afa76ac4f267c3a5cdb9
SHA512aa5aa3285ea5c177eca055949c5f550dbd2d2699202a29efe2077213cbc95fff2a36d99eecce249ac04d95baf149b3d8c557a67fc39ead3229f0b329e83447b7
-
Filesize
81KB
MD5439b3ad279befa65bb40ecebddd6228b
SHA1d3ea91ae7cad9e1ebec11c5d0517132bbc14491e
SHA25624017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d
SHA512a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd
-
Filesize
173KB
MD56774d6fb8b9e7025254148dc32c49f47
SHA1212e232da95ec8473eb0304cf89a5baf29020137
SHA2562b6f1b1ac47cb7878b62e8d6bb587052f86ca8145b05a261e855305b9ca3d36c
SHA5125d9247dce96599160045962af86fc9e5439f66a7e8d15d1d00726ec1b3b49d9dd172d667380d644d05cb18e45a5419c2594b4bcf5a16ea01542ae4d7d9a05c6e
-
Filesize
62KB
MD5eb6bbe091b6e2b0ff53ad736fdfcd456
SHA1fbc73063986f0c1340b1c5c40c22b7dd47c7f1a3
SHA256198e2cee4502f69dfff2dd029308febce3d1e1d4dd9fe122e891bf95c7910d54
SHA512a928c313f0617d7409a96099cbd01b5811f2618c181725cecd45bcf2b36e436578aeedadc0405f8727b966cc2cdf2fcd9788df572d7cb39ebb9e5f532533b4c5
-
Filesize
35KB
MD5cb0564bc74258cb1320c606917ce5a71
SHA15b2bfc0d997cc5b7d985bfadddbfc180cb01f7cf
SHA2560342916a60a7b39bbd5753d85e1c12a4d6f990499753d467018b21cefa49cf32
SHA51243f3afa9801fcf5574a30f4d3e7ae6aff65c7716462f9aba5bc8055887a44bf38fba121639d8b31427e738752fe3b085d1d924de2633f4c042433e1960023f38
-
Filesize
1.3MB
MD5f529dc05c2fb2e9325bcc626de5aa2ff
SHA198e1ee756c496f31b5a63a8f9c968a3821b92b99
SHA2566af8511d62e7e7ed1805a07edd05a7fa83a728f0d24f92e7ed498ae01a0b92f2
SHA512fd07ff25639e4c3eb8b2af2fd3c70d58c79a2fd967995721395e74ffc53c7783cc19fe6047feab656b964024f6c895f9071ee6d4ae1f42d0c89ab62835a1b73d
-
Filesize
4.9MB
MD551e8a5281c2092e45d8c97fbdbf39560
SHA1c499c810ed83aaadce3b267807e593ec6b121211
SHA2562a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
SHA51298b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
-
Filesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
Filesize
771KB
MD5bfc834bb2310ddf01be9ad9cff7c2a41
SHA1fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c
SHA25641ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
SHA5126af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3
-
Filesize
194KB
MD5e2d1c738d6d24a6dd86247d105318576
SHA1384198f20724e4ede9e7b68e2d50883c664eee49
SHA256cdc09fbae2f103196215facd50d108be3eff60c8ee5795dcc80bf57a0f120cdf
SHA5123f9cb64b4456438dea82a0638e977f233faf0a08433f01ca87ba65c7e80b0680b0ec3009fa146f02ae1fdcc56271a66d99855d222e77b59a1713caf952a807da
-
Filesize
6.7MB
MD548ebfefa21b480a9b0dbfc3364e1d066
SHA1b44a3a9b8c585b30897ddc2e4249dfcfd07b700a
SHA2560cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2
SHA5124e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce
-
Filesize
29KB
MD5e1604afe8244e1ce4c316c64ea3aa173
SHA199704d2c0fa2687997381b65ff3b1b7194220a73
SHA25674cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5
SHA5127bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42
-
Filesize
1.7MB
MD5b0261de5ef4879a442abdcd03dedfa3c
SHA17f13684ff91fcd60b4712f6cf9e46eb08e57c145
SHA25628b61545d3a53460f41c20dacf0e0df2ba687a5c85f9ed5c34dbfc7ed2f23e3e
SHA512e39a242e321e92761256b2b4bdde7f9d880b5c64d4778b87fa98bf4ac93a0248e408a332ae214b7ffd76fb9d219555dc10ab8327806d8d63309bf6d147ebbd59
-
Filesize
1.5MB
MD5ef0d7469a88afb64944e2b2d91eb3e7f
SHA1a26fd3de8da3e4aec417cebfa2de78f9ba7cf05b
SHA25623a195e1e3922215148e1e09a249b4fe017a73b3564af90b0f6fd4d9e5dda4da
SHA512909f0b73b64bad84b896a973b58735747d87b5133207cb3d9fa9ce0c026ee59255b7660c43bb86b1ddeef9fbb80b2250719fd379cff7afd9dbec6f6a007ed093
-
Filesize
1.1MB
MD5fc47b9e23ddf2c128e3569a622868dbe
SHA12814643b70847b496cbda990f6442d8ff4f0cb09
SHA2562a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309
SHA5127c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53
-
Filesize
141KB
MD5b4a0b3d5abc631e95c074eee44e73f96
SHA1c22c8baa23d731a0e08757d0449ca3dd662fd9e6
SHA256c89c8a2fcf11d8191c7690027055431906aae827fc7f443f0908ad062e7e653e
SHA51256bafd1c6c77343f724a8430a1f496b4a3160faa9a19ea40796438ae67d6c45f8a13224dcf3d1defb97140a2e47a248dd837801a8cb4674e7890b495aeec538e
-
Filesize
84KB
MD5c5aa0d11439e0f7682dae39445f5dab4
SHA173a6d55b894e89a7d4cb1cd3ccff82665c303d5c
SHA2561700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
SHA512eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5