5909fe1f630fb0d8800592a59ccdb2096a61ed683368b80393026d3a8c594ee4

General

Target

5909fe1f630fb0d8800592a59ccdb2096a61ed683368b80393026d3a8c594ee4.exe
Size

723KB
MD5

0faab34bd499850795852abd6eda43c0
SHA1

a8819d847b9aae428c4c3c34293a033cba7b1b40
SHA256

5909fe1f630fb0d8800592a59ccdb2096a61ed683368b80393026d3a8c594ee4
SHA512

984c8a2063b2bd72dc2d699530772890b189dc462092b2b9b392465e9cb1fb3b597619c082b02888511960775b80fa1524d35d1e1e0e188a7ec39507a68ed8d1
SSDEEP

3072:3twizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOylqwMqle7xa2i1hrxFpKUWZ2p:9uj8NDF3OR9/Qe2HdJ8RAbrycb

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 9 IoCs

Processes:

casino_extensions.exeCasino_ext.execasino_extensions.exeCasino_ext.execasino_extensions.exeCasino_ext.exeLiveMessageCenter.execasino_extensions.exeCasino_ext.exe

pid	process
4256	casino_extensions.exe
1588	Casino_ext.exe
1992	casino_extensions.exe
2412	Casino_ext.exe
3572	casino_extensions.exe
4972	Casino_ext.exe
4224	LiveMessageCenter.exe
1388	casino_extensions.exe
2896	Casino_ext.exe

Drops file in System32 directory 11 IoCs

Processes:

casino_extensions.execasino_extensions.execasino_extensions.execasino_extensions.execasino_extensions.execasino_extensions.exe

description	ioc	process
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe

Drops file in Program Files directory 10 IoCs

Processes:

casino_extensions.execasino_extensions.execasino_extensions.exeCasino_ext.exeCasino_ext.execasino_extensions.exeCasino_ext.exeCasino_ext.exeLiveMessageCenter.execasino_extensions.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	LiveMessageCenter.exe
File created	C:\Program Files (x86)\Internet Explorer\$$202803s.bat	casino_extensions.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Casino_ext.exeCasino_ext.exeCasino_ext.exeLiveMessageCenter.exeCasino_ext.exe

pid	process
1588	Casino_ext.exe
1588	Casino_ext.exe
2412	Casino_ext.exe
2412	Casino_ext.exe
4972	Casino_ext.exe
4972	Casino_ext.exe
4224	LiveMessageCenter.exe
4224	LiveMessageCenter.exe
2896	Casino_ext.exe
2896	Casino_ext.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

5909fe1f630fb0d8800592a59ccdb2096a61ed683368b80393026d3a8c594ee4.exe

pid process

5064 5909fe1f630fb0d8800592a59ccdb2096a61ed683368b80393026d3a8c594ee4.exe

pid	process
5064	5909fe1f630fb0d8800592a59ccdb2096a61ed683368b80393026d3a8c594ee4.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

5909fe1f630fb0d8800592a59ccdb2096a61ed683368b80393026d3a8c594ee4.execasino_extensions.execasino_extensions.exeCasino_ext.execasino_extensions.execasino_extensions.exeCasino_ext.execasino_extensions.execasino_extensions.exeCasino_ext.execasino_extensions.exeLiveMessageCenter.execasino_extensions.execasino_extensions.exeCasino_ext.execasino_extensions.exe

description	pid	process	target process
PID 5064 wrote to memory of 2372	5064	5909fe1f630fb0d8800592a59ccdb2096a61ed683368b80393026d3a8c594ee4.exe	casino_extensions.exe
PID 5064 wrote to memory of 2372	5064	5909fe1f630fb0d8800592a59ccdb2096a61ed683368b80393026d3a8c594ee4.exe	casino_extensions.exe
PID 5064 wrote to memory of 2372	5064	5909fe1f630fb0d8800592a59ccdb2096a61ed683368b80393026d3a8c594ee4.exe	casino_extensions.exe
PID 2372 wrote to memory of 4256	2372	casino_extensions.exe	casino_extensions.exe
PID 2372 wrote to memory of 4256	2372	casino_extensions.exe	casino_extensions.exe
PID 2372 wrote to memory of 4256	2372	casino_extensions.exe	casino_extensions.exe
PID 4256 wrote to memory of 1588	4256	casino_extensions.exe	Casino_ext.exe
PID 4256 wrote to memory of 1588	4256	casino_extensions.exe	Casino_ext.exe
PID 4256 wrote to memory of 1588	4256	casino_extensions.exe	Casino_ext.exe
PID 1588 wrote to memory of 624	1588	Casino_ext.exe	casino_extensions.exe
PID 1588 wrote to memory of 624	1588	Casino_ext.exe	casino_extensions.exe
PID 1588 wrote to memory of 624	1588	Casino_ext.exe	casino_extensions.exe
PID 624 wrote to memory of 1992	624	casino_extensions.exe	casino_extensions.exe
PID 624 wrote to memory of 1992	624	casino_extensions.exe	casino_extensions.exe
PID 624 wrote to memory of 1992	624	casino_extensions.exe	casino_extensions.exe
PID 1992 wrote to memory of 2412	1992	casino_extensions.exe	Casino_ext.exe
PID 1992 wrote to memory of 2412	1992	casino_extensions.exe	Casino_ext.exe
PID 1992 wrote to memory of 2412	1992	casino_extensions.exe	Casino_ext.exe
PID 2412 wrote to memory of 1908	2412	Casino_ext.exe	casino_extensions.exe
PID 2412 wrote to memory of 1908	2412	Casino_ext.exe	casino_extensions.exe
PID 2412 wrote to memory of 1908	2412	Casino_ext.exe	casino_extensions.exe
PID 1908 wrote to memory of 3572	1908	casino_extensions.exe	casino_extensions.exe
PID 1908 wrote to memory of 3572	1908	casino_extensions.exe	casino_extensions.exe
PID 1908 wrote to memory of 3572	1908	casino_extensions.exe	casino_extensions.exe
PID 3572 wrote to memory of 4972	3572	casino_extensions.exe	Casino_ext.exe
PID 3572 wrote to memory of 4972	3572	casino_extensions.exe	Casino_ext.exe
PID 3572 wrote to memory of 4972	3572	casino_extensions.exe	Casino_ext.exe
PID 4972 wrote to memory of 1724	4972	Casino_ext.exe	casino_extensions.exe
PID 4972 wrote to memory of 1724	4972	Casino_ext.exe	casino_extensions.exe
PID 4972 wrote to memory of 1724	4972	Casino_ext.exe	casino_extensions.exe
PID 1724 wrote to memory of 4224	1724	casino_extensions.exe	LiveMessageCenter.exe
PID 1724 wrote to memory of 4224	1724	casino_extensions.exe	LiveMessageCenter.exe
PID 1724 wrote to memory of 4224	1724	casino_extensions.exe	LiveMessageCenter.exe
PID 4224 wrote to memory of 5096	4224	LiveMessageCenter.exe	casino_extensions.exe
PID 4224 wrote to memory of 5096	4224	LiveMessageCenter.exe	casino_extensions.exe
PID 4224 wrote to memory of 5096	4224	LiveMessageCenter.exe	casino_extensions.exe
PID 5096 wrote to memory of 1388	5096	casino_extensions.exe	casino_extensions.exe
PID 5096 wrote to memory of 1388	5096	casino_extensions.exe	casino_extensions.exe
PID 5096 wrote to memory of 1388	5096	casino_extensions.exe	casino_extensions.exe
PID 1388 wrote to memory of 2896	1388	casino_extensions.exe	Casino_ext.exe
PID 1388 wrote to memory of 2896	1388	casino_extensions.exe	Casino_ext.exe
PID 1388 wrote to memory of 2896	1388	casino_extensions.exe	Casino_ext.exe
PID 2896 wrote to memory of 2280	2896	Casino_ext.exe	casino_extensions.exe
PID 2896 wrote to memory of 2280	2896	Casino_ext.exe	casino_extensions.exe
PID 2896 wrote to memory of 2280	2896	Casino_ext.exe	casino_extensions.exe
PID 2280 wrote to memory of 1972	2280	casino_extensions.exe	cmd.exe
PID 2280 wrote to memory of 1972	2280	casino_extensions.exe	cmd.exe
PID 2280 wrote to memory of 1972	2280	casino_extensions.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5909fe1f630fb0d8800592a59ccdb2096a61ed683368b80393026d3a8c594ee4.exe
"C:\Users\Admin\AppData\Local\Temp\5909fe1f630fb0d8800592a59ccdb2096a61ed683368b80393026d3a8c594ee4.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5064

C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
"C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\casino_extensions.exe
C:\Windows\system32\casino_extensions.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4256

C:\Windows\SysWOW64\Casino_ext.exe
C:\Windows\SysWOW64\Casino_ext.exe
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1588

C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
"C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
5⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SysWOW64\casino_extensions.exe
C:\Windows\system32\casino_extensions.exe
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\Casino_ext.exe
C:\Windows\SysWOW64\Casino_ext.exe
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2412

C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
"C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
8⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\casino_extensions.exe
C:\Windows\system32\casino_extensions.exe
9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3572

C:\Windows\SysWOW64\Casino_ext.exe
C:\Windows\SysWOW64\Casino_ext.exe
10⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4972

C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
"C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
11⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\LiveMessageCenter.exe
C:\Windows\system32\LiveMessageCenter.exe /part2
12⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4224

C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
"C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
13⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5096

C:\Windows\SysWOW64\casino_extensions.exe
C:\Windows\system32\casino_extensions.exe
14⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\Casino_ext.exe
C:\Windows\SysWOW64\Casino_ext.exe
15⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896

C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
"C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
16⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2280

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c $$2028~1.BAT
17⤵
PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\$$202803s.bat

Filesize
81B

MD5
4777bf695815d870d27ed4a38a8f0840

SHA1
565412b5182bca7a221448dba78369c42d1c4a0c

SHA256
c08018226d9a45ab277a01ca35f519ff7ea1cb450d080e24b0f590739654241d

SHA512
87e792d326c5a9d2d92984ec4c34d2af9d616a4676a7d69df73b09975fd077d96077ae2528b6fc05752110eb4e406c3e9d94d49d0a74eeaba6bc6a48bca8ac1d

Download Submit
C:\Windows\SysWOW64\LiveMessageCenter.exe

Filesize
736KB

MD5
eeb55ec47ef16ba154050eab5cc50f2f

SHA1
c6ea18cffcfaf2bd3fa6eb04704a7314c084ab12

SHA256
6abb754ecbbac2ec40964f8c9a4f361a75beca97d118c707fc7b90ecab71458f

SHA512
533a85df4d0a45814d65534391d1d5f6bcc562f10cd62a7112528ed2b4ff452bbb82057a684894606a84fd02bd84ac23984e554166e472166c57549867d1684a

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
739KB

MD5
226e48daca57ed7fbdb8380fddb2644e

SHA1
ff978db71c5db7d2708df7b2668cc74fc3144a97

SHA256
1449d266ea2b1122c1309608ae78f3433da4bc2fd223051ecfd619c26417a226

SHA512
222530a79dff98a6562109f7e25a79fbfcbf17d535f20e209925f6cfa2b69f3602384b247ec977fb4386d3a4269007ac0acc48866792b81e6742bc80afeb9705

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
730KB

MD5
0955b9231359ef90db7aac4a9bb05af6

SHA1
737f7891d1400756a949ded26d0e268bf3a5baf1

SHA256
8d325d406f21f5a43191664394eb67c8fd3446b78adb539bf268020f9c92d34a

SHA512
5e75f22fa1c816818a6947aff8ca89a0c8c696f4bfaaea9581bba0885d08505851d2e82371f7e3ae4123a5413c40f5ee95bb1769384b8019974f6aa0f94ac1e1

Download Submit
memory/4256-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5064-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads