36ee18c553e3463dff8c087c93ee54ef8b1b3f5e8408358ff8abef6adec73e8d

General

Target

36ee18c553e3463dff8c087c93ee54ef8b1b3f5e8408358ff8abef6adec73e8d.exe
Size

623KB
MD5

0e3032eb8d5e9402786852acea00c450
SHA1

b39591df4b70a4a69c2647e50f1196e5c2e2ac89
SHA256

36ee18c553e3463dff8c087c93ee54ef8b1b3f5e8408358ff8abef6adec73e8d
SHA512

38f8abb9f4ad97a5b75d3a54a62c7a4805e99ee3ebb0caebf97cfe5b178fb5efe783b5464d43175339eb4f500de47bc0d54702427270963e11ba707d504449cb
SSDEEP

3072:vtwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOLlqw1aQuoYKN6LSSe9o6Y:luj8NDF3OR9/Qe2HdklruoYk6LReM

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2736 cmd.exe
Executes dropped EXE 5 IoCs

Processes:

casino_extensions.exeCasino_ext.execasino_extensions.exeCasino_ext.exeLiveMessageCenter.exe

pid process

1788 casino_extensions.exe
2080 Casino_ext.exe
2600 casino_extensions.exe
2712 Casino_ext.exe
2744 LiveMessageCenter.exe

pid	process
2736	cmd.exe

pid	process
1788	casino_extensions.exe
2080	Casino_ext.exe
2600	casino_extensions.exe
2712	Casino_ext.exe
2744	LiveMessageCenter.exe

Loads dropped DLL 6 IoCs

Processes:

casino_extensions.execasino_extensions.execasino_extensions.exe

pid	process
2588	casino_extensions.exe
2588	casino_extensions.exe
2192	casino_extensions.exe
2192	casino_extensions.exe
2724	casino_extensions.exe
2724	casino_extensions.exe

Drops file in System32 directory 9 IoCs

Processes:

casino_extensions.execasino_extensions.execasino_extensions.execasino_extensions.exe

description	ioc	process
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe

Drops file in Program Files directory 6 IoCs

Processes:

casino_extensions.exeCasino_ext.execasino_extensions.exeCasino_ext.exeLiveMessageCenter.execasino_extensions.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	LiveMessageCenter.exe
File created	C:\Program Files (x86)\Internet Explorer\$$202803s.bat	casino_extensions.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Casino_ext.exeCasino_ext.exeLiveMessageCenter.exe

pid process

2080 Casino_ext.exe
2712 Casino_ext.exe
2744 LiveMessageCenter.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

36ee18c553e3463dff8c087c93ee54ef8b1b3f5e8408358ff8abef6adec73e8d.exe

pid process

2036 36ee18c553e3463dff8c087c93ee54ef8b1b3f5e8408358ff8abef6adec73e8d.exe

pid	process
2080	Casino_ext.exe
2712	Casino_ext.exe
2744	LiveMessageCenter.exe

pid	process
2036	36ee18c553e3463dff8c087c93ee54ef8b1b3f5e8408358ff8abef6adec73e8d.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

36ee18c553e3463dff8c087c93ee54ef8b1b3f5e8408358ff8abef6adec73e8d.execasino_extensions.execasino_extensions.exeCasino_ext.execasino_extensions.execasino_extensions.exeCasino_ext.execasino_extensions.exeLiveMessageCenter.execasino_extensions.exe

description	pid	process	target process
PID 2036 wrote to memory of 2588	2036	36ee18c553e3463dff8c087c93ee54ef8b1b3f5e8408358ff8abef6adec73e8d.exe	casino_extensions.exe
PID 2036 wrote to memory of 2588	2036	36ee18c553e3463dff8c087c93ee54ef8b1b3f5e8408358ff8abef6adec73e8d.exe	casino_extensions.exe
PID 2036 wrote to memory of 2588	2036	36ee18c553e3463dff8c087c93ee54ef8b1b3f5e8408358ff8abef6adec73e8d.exe	casino_extensions.exe
PID 2036 wrote to memory of 2588	2036	36ee18c553e3463dff8c087c93ee54ef8b1b3f5e8408358ff8abef6adec73e8d.exe	casino_extensions.exe
PID 2588 wrote to memory of 1788	2588	casino_extensions.exe	casino_extensions.exe
PID 2588 wrote to memory of 1788	2588	casino_extensions.exe	casino_extensions.exe
PID 2588 wrote to memory of 1788	2588	casino_extensions.exe	casino_extensions.exe
PID 2588 wrote to memory of 1788	2588	casino_extensions.exe	casino_extensions.exe
PID 1788 wrote to memory of 2080	1788	casino_extensions.exe	Casino_ext.exe
PID 1788 wrote to memory of 2080	1788	casino_extensions.exe	Casino_ext.exe
PID 1788 wrote to memory of 2080	1788	casino_extensions.exe	Casino_ext.exe
PID 1788 wrote to memory of 2080	1788	casino_extensions.exe	Casino_ext.exe
PID 2080 wrote to memory of 2192	2080	Casino_ext.exe	casino_extensions.exe
PID 2080 wrote to memory of 2192	2080	Casino_ext.exe	casino_extensions.exe
PID 2080 wrote to memory of 2192	2080	Casino_ext.exe	casino_extensions.exe
PID 2080 wrote to memory of 2192	2080	Casino_ext.exe	casino_extensions.exe
PID 2192 wrote to memory of 2600	2192	casino_extensions.exe	casino_extensions.exe
PID 2192 wrote to memory of 2600	2192	casino_extensions.exe	casino_extensions.exe
PID 2192 wrote to memory of 2600	2192	casino_extensions.exe	casino_extensions.exe
PID 2192 wrote to memory of 2600	2192	casino_extensions.exe	casino_extensions.exe
PID 2600 wrote to memory of 2712	2600	casino_extensions.exe	Casino_ext.exe
PID 2600 wrote to memory of 2712	2600	casino_extensions.exe	Casino_ext.exe
PID 2600 wrote to memory of 2712	2600	casino_extensions.exe	Casino_ext.exe
PID 2600 wrote to memory of 2712	2600	casino_extensions.exe	Casino_ext.exe
PID 2712 wrote to memory of 2724	2712	Casino_ext.exe	casino_extensions.exe
PID 2712 wrote to memory of 2724	2712	Casino_ext.exe	casino_extensions.exe
PID 2712 wrote to memory of 2724	2712	Casino_ext.exe	casino_extensions.exe
PID 2712 wrote to memory of 2724	2712	Casino_ext.exe	casino_extensions.exe
PID 2724 wrote to memory of 2744	2724	casino_extensions.exe	LiveMessageCenter.exe
PID 2724 wrote to memory of 2744	2724	casino_extensions.exe	LiveMessageCenter.exe
PID 2724 wrote to memory of 2744	2724	casino_extensions.exe	LiveMessageCenter.exe
PID 2724 wrote to memory of 2744	2724	casino_extensions.exe	LiveMessageCenter.exe
PID 2744 wrote to memory of 2856	2744	LiveMessageCenter.exe	casino_extensions.exe
PID 2744 wrote to memory of 2856	2744	LiveMessageCenter.exe	casino_extensions.exe
PID 2744 wrote to memory of 2856	2744	LiveMessageCenter.exe	casino_extensions.exe
PID 2744 wrote to memory of 2856	2744	LiveMessageCenter.exe	casino_extensions.exe
PID 2856 wrote to memory of 2736	2856	casino_extensions.exe	cmd.exe
PID 2856 wrote to memory of 2736	2856	casino_extensions.exe	cmd.exe
PID 2856 wrote to memory of 2736	2856	casino_extensions.exe	cmd.exe
PID 2856 wrote to memory of 2736	2856	casino_extensions.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\36ee18c553e3463dff8c087c93ee54ef8b1b3f5e8408358ff8abef6adec73e8d.exe
"C:\Users\Admin\AppData\Local\Temp\36ee18c553e3463dff8c087c93ee54ef8b1b3f5e8408358ff8abef6adec73e8d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2036

C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
"C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\SysWOW64\casino_extensions.exe
C:\Windows\system32\casino_extensions.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\Casino_ext.exe
C:\Windows\SysWOW64\Casino_ext.exe
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2080

C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
"C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
5⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\SysWOW64\casino_extensions.exe
C:\Windows\system32\casino_extensions.exe
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\SysWOW64\Casino_ext.exe
C:\Windows\SysWOW64\Casino_ext.exe
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2712

C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
"C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
8⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\LiveMessageCenter.exe
C:\Windows\system32\LiveMessageCenter.exe /part2
9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2744

C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
"C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
10⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\SysWOW64\cmd.exe
cmd /c $$2028~1.BAT
11⤵
- Deletes itself
PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\$$202803s.bat

Filesize
81B

MD5
4777bf695815d870d27ed4a38a8f0840

SHA1
565412b5182bca7a221448dba78369c42d1c4a0c

SHA256
c08018226d9a45ab277a01ca35f519ff7ea1cb450d080e24b0f590739654241d

SHA512
87e792d326c5a9d2d92984ec4c34d2af9d616a4676a7d69df73b09975fd077d96077ae2528b6fc05752110eb4e406c3e9d94d49d0a74eeaba6bc6a48bca8ac1d

Download Submit
\Windows\SysWOW64\LiveMessageCenter.exe

Filesize
633KB

MD5
42d922f0221a57ed6b5d6d72d7d26b6b

SHA1
f8246f911c7f47586c66cbe7f46a1e262ca3f88b

SHA256
73811d35c50cd8b0e2c176e11a28aaf255e7014d8268bdae7ebe9c72a7a3c06c

SHA512
850d505e8ae49f5190333bb00afe5b587a95f39d4e7974187b29595051b5b77d743d0cfcc26e910bf90016be28d88c8da47a2b71f20d561f96e631fda01f1541

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
629KB

MD5
cc6aada8a5bfb8ad44f11a80f1a0fe20

SHA1
6e1a9c406bb57155eec12215f8963bc8c0d83224

SHA256
db3658113500395f036af93b7b5bad07830dca787d5036826765696080014c75

SHA512
381892015b2d83393268e05b5300dba1fc79ccaa4adaa7ac057b2c36bd73757348ac742e385dacb748b9b138df42d7f25f6fa30886fa6e9eb794195d05ae0a13

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
624KB

MD5
ebb76d9ca85d6caaddab925204110d25

SHA1
f288e06190d1ad3482b3bfb27dc78a5c49d93cc6

SHA256
9ff67178a8d573c66dd6282aab7da4df8d97f46ba3d9b34223ba0aa39a808b9b

SHA512
7cc5e81d7c7c9a4d10cd14caa1195cbc50bba55ee7a0a7a0aaae8ae55a5c461595de18a257e07b3ea36c1f8102161346cdfd4d2115d2d15a924cc8fd93fae569

Download Submit
memory/1788-13-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2036-14-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2588-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads