96bc730089c54a18a35560e1d34990944009f772ef8a778353cf300efcb61cb8

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_karkat.exe
Size

22.3MB
MD5

c67fef2a45f3247170ffb8a4b866682d
SHA1

1e58b25a213cd7f94dc059854d99e9ee86aa79fa
SHA256

96bc730089c54a18a35560e1d34990944009f772ef8a778353cf300efcb61cb8
SHA512

09fbb36beada84559700e623fef910f58e67478cb2af228ac2f10be0b02ba5e01e90304c13fc1ff0f5ec34737c9bef83922aa49c459a99381e79fed36befa649
SSDEEP

393216:WqPQ5x5zbff2VDWZYFbFxLm6wwPz1Qr/nsevwYZwoo4IFF7c0LmVKW1186nGrZwB:NI5x5/ff2tWZSRx6haRQ46wYXhIFF7c3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2292	setup_karkat.tmp

Loads dropped DLL 2 IoCs

pid	Process
1628	setup_karkat.exe
2292	setup_karkat.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2292	1628	setup_karkat.exe	28
PID 1628 wrote to memory of 2292	1628	setup_karkat.exe	28
PID 1628 wrote to memory of 2292	1628	setup_karkat.exe	28
PID 1628 wrote to memory of 2292	1628	setup_karkat.exe	28
PID 1628 wrote to memory of 2292	1628	setup_karkat.exe	28
PID 1628 wrote to memory of 2292	1628	setup_karkat.exe	28
PID 1628 wrote to memory of 2292	1628	setup_karkat.exe	28

C:\Users\Admin\AppData\Local\Temp\setup_karkat.exe
"C:\Users\Admin\AppData\Local\Temp\setup_karkat.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\is-3PGV1.tmp\setup_karkat.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3PGV1.tmp\setup_karkat.tmp" /SL5="$6014E,22462066,832512,C:\Users\Admin\AppData\Local\Temp\setup_karkat.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-K8VP6.tmp\mp_buttons.png

Filesize
4KB

MD5
9d42c92b4bfd6dd4d2ab72023eedf828

SHA1
7f266cc7be4ea2f8a483beb17624c9ce262815f5

SHA256
8c83fcf81ba4c5bca71da0be33ded954f2ddbb34f9d9c615e96cdfbacc5a5f34

SHA512
f7a74a644d4a134e1546b0926e15c8e0e499295b02fa904690af45b494dd2ce5fadb1a62201346d2eb85330239053550bb931ab276ba4d7d4475236567e85b03

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K8VP6.tmp\mp_skin-inner.jpg

Filesize
3KB

MD5
b4cd55cc361e6e76fda70c43f4ff252e

SHA1
50d0f42290c58fcaa228c775ecf4e2ddad89b7ab

SHA256
2132e5587ccfafd1e9ce2cbea1e1a5389a2dc3bee81890f8d4d63382e1bff3d2

SHA512
14f24d0d1d1987a86c781bd646900130d67a360a033ac49bbb60d92c95480789f165bfb6bf51f233b7c14bcfca67773f5b11aad98ccd4b4d712705cae6f9e9f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K8VP6.tmp\mp_skin-top.jpg

Filesize
19KB

MD5
f7e05f30b22e610e3929350d90228b48

SHA1
21b3b9797fb10d21804c398e66f41b9b4afbcab8

SHA256
a5af5fe1654c8f35ad3e8b41862e6b91a5e3afde7e71f73f8cef6b7304088f98

SHA512
83662f18b3fcd5a82894d979b6261818f1409d307f764c96364eaa8704bfdf8379b5e73213e91ce40da77c2c676eaf1db5795138608db3476c63d8ba059e57cb

Download Submit
\Users\Admin\AppData\Local\Temp\is-3PGV1.tmp\setup_karkat.tmp

Filesize
3.1MB

MD5
84dd46124708d3e9eba85620f3c4b3c2

SHA1
e605dab5ceeb96a63c78decfa6b0f769217db7f6

SHA256
1ae4a495134031ba62031d894afceb67c727a8f2b6b469fae828c66593f22710

SHA512
188eb1d590f7a01c0cff911f6d8759f563cbe7dfac3428248f9f0c8bf8ef67b043811b4f68e7d094ba3d56b3ef4432236c1168ae8bfd8783848d586907f622cb

Download Submit
\Users\Admin\AppData\Local\Temp\is-K8VP6.tmp\botva2.dll

Filesize
35KB

MD5
0177746573eed407f8dca8a9e441aa49

SHA1
6b462adf78059d26cbc56b3311e3b97fcb8d05f7

SHA256
a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

SHA512
d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

Download Submit
memory/1628-91-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1628-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1628-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2292-8-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download
memory/2292-70-0x0000000002060000-0x00000000021A0000-memory.dmp

Filesize
1.2MB

Download
memory/2292-90-0x0000000002060000-0x00000000021A0000-memory.dmp

Filesize
1.2MB

Download
memory/2292-85-0x0000000002060000-0x00000000021A0000-memory.dmp

Filesize
1.2MB

Download
memory/2292-80-0x0000000002060000-0x00000000021A0000-memory.dmp

Filesize
1.2MB

Download
memory/2292-75-0x0000000002060000-0x00000000021A0000-memory.dmp

Filesize
1.2MB

Download
memory/2292-16-0x0000000003700000-0x000000000370E000-memory.dmp

Filesize
56KB

Download
memory/2292-93-0x0000000003700000-0x000000000370E000-memory.dmp

Filesize
56KB

Download
memory/2292-92-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download
memory/2292-99-0x0000000003700000-0x000000000370E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads