Malware Analysis Report

2025-08-10 21:24

Sample ID 240530-br2xasac82
Target a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9
SHA256 a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9

Threat Level: Shows suspicious behavior

The file a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9 was found to be: Shows suspicious behavior.

Malicious Activity Summary


Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 01:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 01:23

Reported

2024-05-30 01:26

Platform

win7-20240221-en

Max time kernel

119s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp8161.tmp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp8161.tmp.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2168 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2168 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2168 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2168 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2072 wrote to memory of 2916 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2072 wrote to memory of 2916 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2072 wrote to memory of 2916 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2072 wrote to memory of 2916 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2168 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Users\Admin\AppData\Local\Temp\tmp8161.tmp.exe
PID 2168 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Users\Admin\AppData\Local\Temp\tmp8161.tmp.exe
PID 2168 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Users\Admin\AppData\Local\Temp\tmp8161.tmp.exe
PID 2168 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Users\Admin\AppData\Local\Temp\tmp8161.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe

"C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mjt1spn1\mjt1spn1.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8527.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA6437F59AAFB45D39B96695D7CA826.TMP"

C:\Users\Admin\AppData\Local\Temp\tmp8161.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp8161.tmp.exe" C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe

Network

N/A

Files

memory/2168-0-0x0000000073ECE000-0x0000000073ECF000-memory.dmp

memory/2168-1-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

memory/2168-7-0x0000000073EC0000-0x00000000745AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mjt1spn1\mjt1spn1.cmdline

MD5 069ceebeff14f7cd0d1342c8e61c211d
SHA1 eeabbe070785a82bc27ed47f9aaabd4911a7b2b3
SHA256 1e136370823200a3bc2253964f9bc5a6fdd5cd6e1499157308a1e90da23d43cf
SHA512 9573df164eeb45bb11892046157d42cb40d7c7f7401bc10393b36c12f4c7502ddd0b616bfaa2762712d5cbb07ddb97c0c7e95f9a8a4f177d5f83f112fcc1d49f

C:\Users\Admin\AppData\Local\Temp\mjt1spn1\mjt1spn1.0.vb

MD5 8219bb6e64b6646c82d3822b92d106aa
SHA1 794c435b3484631c49863b680845d51bb1742c8e
SHA256 ca84046ab8ccde446ff4046f9b8a8e5b3e6470ee4c87890c55727acded39c694
SHA512 180f22690088ecb3fafd8d4539da1eebd3e4a7bc22e9e9edc20af0d653bd39e4b4265e8b26dfd9c7c2defd00c90abb1c26c13c0d5861a13de929ad792baba14d

C:\Users\Admin\AppData\Local\Temp\RE.resources

MD5 fc1d2c43471c2cc7def37311b4a7b2dc
SHA1 1a56d0ca7ce6ab351ce996e29e96553c23222c8c
SHA256 2efb6b83655ba8ef82c59ed2a2dd92e549b4792885b5c84dcaa02f0b11e73b4e
SHA512 55a8832a852e11f5538bc479b9a29978d78135bb6d5c72b9fffee69a3033ae6357ea941f42fbfef01fa4975897af312f93322ee3be930e26d3b2cdc166a7abb8

C:\Users\Admin\AppData\Local\Temp\vbcA6437F59AAFB45D39B96695D7CA826.TMP

MD5 f1eae47aafeb7535f8b3fa488e286704
SHA1 7cadff1686550d9377fb288cd58390cbd4b4bfaa
SHA256 bbd78bfffa78faf6da1acb6e7bb57109a9ba9a75e7655fa89c94130fb40107ac
SHA512 9f53b27818079d45c90d69fa8e248cbe3ab55316b75608422f2d5de697252788bdf805fcdc56c75600a15f2fb6d9b170cd611ab6708947fd547c4a44e8754c40

C:\Users\Admin\AppData\Local\Temp\RES8527.tmp

MD5 b253778983896e09c844908ebd46c85d
SHA1 fd64bb6f8f688db259c9f3d9818842b56f891847
SHA256 06b2a98af744b7fac966bc72eb5779422570986fd5da11478ea3d0f6fb99ad93
SHA512 3cf2306220f5e2fa7aa9a3d3e1aa82fd00483f16616b050e3caf18ff8ecfa852ce43d18d3da196101256af982d94357a8e2e271a88fe54469c45acd07bc3098c

C:\Users\Admin\AppData\Local\Temp\tmp8161.tmp.exe

MD5 288cb96b8024af9c1aca56839417ee2f
SHA1 c0ac51ecce3b69f07bec24ec311802179175c676
SHA256 a50149b79cc5d8c08d23a230c56a00a3a8bf41478eb5fa069a2a1815626f5476
SHA512 abcaf2360468e19974d5cd80057c05fd4baf856518ce12f3151d53c9c5cc6e32aa32ce8f6cd5ebb2ad14cbd8a102adc6e5c8283f1958ecaa5b5757da61df2a31

memory/2168-23-0x0000000073EC0000-0x00000000745AE000-memory.dmp

memory/2552-24-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 01:23

Reported

2024-05-30 01:26

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpF02D.tmp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpF02D.tmp.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 216 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 216 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 216 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4640 wrote to memory of 3048 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4640 wrote to memory of 3048 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4640 wrote to memory of 3048 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 216 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Users\Admin\AppData\Local\Temp\tmpF02D.tmp.exe
PID 216 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Users\Admin\AppData\Local\Temp\tmpF02D.tmp.exe
PID 216 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe C:\Users\Admin\AppData\Local\Temp\tmpF02D.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe

"C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f5zd0wql\f5zd0wql.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF211.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFB576C2ACE714992B538EFCEBC653C83.TMP"

C:\Users\Admin\AppData\Local\Temp\tmpF02D.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpF02D.tmp.exe" C:\Users\Admin\AppData\Local\Temp\a85a28cc800025b71c750ef4e6ff7cd183be6854bd9589c74a28b2a2a39655a9.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4244,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 42.56.20.217.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/216-0-0x000000007467E000-0x000000007467F000-memory.dmp

memory/216-1-0x0000000000010000-0x000000000001A000-memory.dmp

memory/216-2-0x0000000004A10000-0x0000000004AAC000-memory.dmp

memory/216-8-0x0000000074670000-0x0000000074E20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f5zd0wql\f5zd0wql.cmdline

MD5 f206b976f2b6bd147aadd380f5b638e4
SHA1 1565efc0b646948cfded9e2397544679e20a65b7
SHA256 37cf671654d163733dca989804928bfe15958b0aec93c2d914f98dfe35a61d39
SHA512 d1c291ef9e6a97ac7a35401d8dcc17cabaf4d7d89e4dc0f3888866e96693192910389e0bb9bc5f10eaf9266dd138bb5db3fc211062bea4c72a7f9fd23404ed42

C:\Users\Admin\AppData\Local\Temp\f5zd0wql\f5zd0wql.0.vb

MD5 7613f4ab6c7f5ed05598bc32b3ffd345
SHA1 1b3ba08066d5dd8bc15c67d2572154d3da841aca
SHA256 d282dfae22a0a3521428b731d2c3dbd7b4f1b700033fa40f494773291aaa88e2
SHA512 0167c5e71d795e24cb862d6a0e3318cb3bb73a4842246152bfbaf45b3b4502da434884eca00a4c28dba947a2af9f1075174a586185037316289a6a878ecbda85

C:\Users\Admin\AppData\Local\Temp\RE.resources

MD5 cbd7b57c2280f69333a82d3a6fdfac69
SHA1 6ec39946ba6595b1412838a83776e08fd3c8f8f0
SHA256 d63c8e287a291be58e64bd94dbb64de4f85b456cdcc1715b1655090f16bf1271
SHA512 6f27cd58226e3816fda51cf1594ae571a491530e80fcfb18ff3bba887085dbd46d0f642660b48b5fa32d3f80cd27835bb0373a3251d73a60ff1ecbb66b81ed28

C:\Users\Admin\AppData\Local\Temp\vbcFB576C2ACE714992B538EFCEBC653C83.TMP

MD5 0b81b4a2d91517df8da1c03f51a38445
SHA1 08be5ccafb91732501eea93393d7607d45553fa5
SHA256 88824599c40972f47852d8855cd553cc5e0da73957a37bf6147efb689faf1b57
SHA512 62e313845259acb21fd73a3cfc4fffec2dbb0d0b70c992b541dc7ce54d58ad1966bc48521b0004c24e64eaf3d70a6eaa26c7f8cb6d2a42fc39667c00018e9050

C:\Users\Admin\AppData\Local\Temp\RESF211.tmp

MD5 6ad475ce7c1767827a54bab1ab77d00a
SHA1 a26e28182f0d06fad96fdcfd012137ee3f39fa15
SHA256 84dd54737e80d01512ec08caf2400378dfa3ddcac17bf1bbfd94b30176d7dc73
SHA512 83ea38712ca002b6c4ff7ba2f280a7fe284cd685daabb05f49728d64ef53bf9454c7486beabbed9c66093d77d8f2769286a57d394ef9c2f6ae79bf537540158d

C:\Users\Admin\AppData\Local\Temp\tmpF02D.tmp.exe

MD5 c14bf883094935549a3bd2ff97f64a12
SHA1 035257a173637715b73b47d6518a07b3e0001e5f
SHA256 0973144c894a34e8646ced501162e607b80d8763648d3d471835a70e2cad3901
SHA512 425315f367d31f09b73161d1788d9d1240f58be4391c3ba8cb459e6440546d4f1b634b93fa749dd0d06b6c46c5b31ccf9c22c9bf52f5f74bb8edb7e88046458e

memory/216-24-0x0000000074670000-0x0000000074E20000-memory.dmp

memory/756-25-0x0000000074670000-0x0000000074E20000-memory.dmp

memory/756-26-0x0000000000870000-0x000000000087A000-memory.dmp

memory/756-27-0x00000000057C0000-0x0000000005D64000-memory.dmp

memory/756-28-0x00000000052B0000-0x0000000005342000-memory.dmp

memory/756-30-0x0000000074670000-0x0000000074E20000-memory.dmp