Analysis
-
max time kernel
141s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 02:27
General
-
Target
Revo Uninstaller Pro 5.2.6.exe
-
Size
18.5MB
-
MD5
2413dc2fe7067dd7738d75446c140096
-
SHA1
f246ac96e8eb790593ceb0e37896542efc67afe7
-
SHA256
aa15d5ded58e1dcb2099806b996750c23c2bcb6026f9a5876a8a9ba0e86e5531
-
SHA512
a49312f62dae510f3f986508fe7dd500650afe95d2f6b92081f33c77636ff5d73c0b3fbcb6b3dc8120b8b83a95f8d82e46cf529263859ec2197f9bdf234b1bcf
-
SSDEEP
393216:gIBJiczqi8Alo2OtD6Zni1cOK8ZNK/WrH9PF2q5XFpBjFSF24S7ioXyj:RJ31z0VJOW79t2uXFp1FSE4AiCyj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro 5.2.6.exe"C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro 5.2.6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1K7BR.tmp\Revo Uninstaller Pro 5.2.6.tmp"C:\Users\Admin\AppData\Local\Temp\is-1K7BR.tmp\Revo Uninstaller Pro 5.2.6.tmp" /SL5="$9014E,19073109,67072,C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro 5.2.6.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
913KB
MD5c0989fb1a591ef0539bdae060b14f5d6
SHA10460fb232d3aba235b044fecc59ee6a104cf3abc
SHA256fb086910b21b2bf40ed9fe21f81280d3b8968fe2cae88b55404a0721d4aa31e2
SHA512fd935276ef7d2d199e5e98a5e2d4ebc37e2bed41dbea8c44fb74947890d6f9a56dba6cb0d2620ccf05d1ada042309ed644d877b502e05fdc47f6e77eae06d6aa
-
Filesize
66KB
MD586a1311d51c00b278cb7f27796ea442e
SHA1ac08ac9d08f8f5380e2a9a65f4117862aa861a19
SHA256e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
SHA512129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
-
Filesize
3.0MB
MD5b0ca93ceb050a2feff0b19e65072bbb5
SHA17ebbbbe2d2acd8fd516f824338d254a33b69f08d
SHA2560e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
SHA51237242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
-
Filesize
988KB
-
Filesize
88KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
988KB
-
Filesize
4KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
988KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
988KB
-
Filesize
92KB
-
Filesize
40KB