Overview

overview

4

Static

static

1

506a508b6a...f9.exe

windows7-x64

4

506a508b6a...f9.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    142s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 08:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    506a508b6a6f236185fd9c2689f548c7085948ceb0e99cc8d5c7c2b81bbe80f9.exe

  • Size

    69.7MB

  • MD5

    c74ac8e2372d7ffbf59df8e5d50f81cf

  • SHA1

    095e3ef202ed82c48a07899b5b876ed2963b8228

  • SHA256

    506a508b6a6f236185fd9c2689f548c7085948ceb0e99cc8d5c7c2b81bbe80f9

  • SHA512

    c6472e1e3431b09b544139527df18ba5bc555b340bbc777429f2e70cfd65783a2dc96aca0dc7884670cd404463d646b85e9d0dd50aa1e7050281dacee603b16c

  • SSDEEP

    1572864:VhKa+R1aXgAHrQpGD+TYRakyjFTzjTxBvds69rEe:VD+pGCTYm5TPTxhds6R

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 12 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\506a508b6a6f236185fd9c2689f548c7085948ceb0e99cc8d5c7c2b81bbe80f9.exe
    "C:\Users\Admin\AppData\Local\Temp\506a508b6a6f236185fd9c2689f548c7085948ceb0e99cc8d5c7c2b81bbe80f9.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Users\Admin\AppData\Local\Temp\is-UP5GD.tmp\506a508b6a6f236185fd9c2689f548c7085948ceb0e99cc8d5c7c2b81bbe80f9.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-UP5GD.tmp\506a508b6a6f236185fd9c2689f548c7085948ceb0e99cc8d5c7c2b81bbe80f9.tmp" /SL5="$901C0,72059904,900608,C:\Users\Admin\AppData\Local\Temp\506a508b6a6f236185fd9c2689f548c7085948ceb0e99cc8d5c7c2b81bbe80f9.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-KDKGQ.tmp\dlmgr.dll
    Filesize

    194KB

    MD5

    c41a84ead571651d3f54472e2534b590

    SHA1

    e476e6bc8d3940bf8b84a9b3fe606136387c9cf6

    SHA256

    da9fb4b2bdec84d4b6ee6602666b55d762a0f925863b97ba9f4134e26e5be370

    SHA512

    a5029489ade04efea880fbde25f338f686a1ae2a35c5e5101968393c3932c9af48b374d0ff6e37551a359248c1105327c4cf5776c062135e0d52a176ed1e3b09

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-KDKGQ.tmp\dvssyshelper.dll
    Filesize

    471KB

    MD5

    6cbb8dd7c6d931a0aa47684ba70501f6

    SHA1

    9079a507c330585743f599924cdeadfda9a6e1a2

    SHA256

    f3b4f343049a363b0f0055580f7091d43a89dcbffeec1cb7b65df2c2bf7bd3c4

    SHA512

    85c33b2a527c1d5311745dc47afa1b3a5e5d99f460407134b69bd420a747e4c9cbbfe8fe7517d7c494c42a9bf2f9efca78939c9d5d41092ff1f9b049938e5c7d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-KDKGQ.tmp\jansson.dll
    Filesize

    51KB

    MD5

    bd85ae31f57e240dd145a0b1b3a23d1d

    SHA1

    c24a6fc4296c9b0f60d4cc32769306892b4bee0d

    SHA256

    e80bb21d45ff59da6cb22b0fb63267e025be3b11f89006661d077d852fb0a110

    SHA512

    02abf4fb5f445728994c11854e85e9a37faaf7c8d69f8dad31198bd4402df85935debfc4261f45cf42388440e58be74a477310a9c2126c35ea2e9609674f1d7a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-KDKGQ.tmp\libcrypto-1_1.dll
    Filesize

    2.4MB

    MD5

    d525d6132163a1ccc8bba68892452a64

    SHA1

    9f1fbbafb940cd7fce729e3948041d506b226c26

    SHA256

    375639ffb9efdbc5d978d020be5867c3e6fe29cff9ce54be3e584d262673569f

    SHA512

    366e58246ac7e750770a2ffd18f82d64049eae17246227d92e37876392c5b22a35c62cdd3ac4b437fbcf51bae83751ff07c97201bca48e861f65bd0a8755e839

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-KDKGQ.tmp\libcurl.dll
    Filesize

    320KB

    MD5

    d5e314b1856826ed2c729996718dde82

    SHA1

    5442c7d1b33fe561f12332e4accc9991d9600da0

    SHA256

    a3e8dfa038824da6f56aad2921b12f383e318e1dbdfad603d8df16ebc5a02ad2

    SHA512

    55b9e1b2eaa984aeff32a798ceef1762880bfef862c25dbb7174de64f7b3e8f6e4c0167291d47840c35dc3d12dcc49aae03612815890bb5c8262461a430ebd1f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-KDKGQ.tmp\libssl-1_1.dll
    Filesize

    533KB

    MD5

    3503885267b930c992cf2fbe028c3b4b

    SHA1

    b82d0a36168b306336227b7677d45d842d932199

    SHA256

    ba5084c0c44317d42fcdb2fd76ce07b73c5048b66f932242945095c5e2e2668b

    SHA512

    a4b68c4bd0dcc1732e0b7e109c4bbb37709309460896a8a992cf4ae26e9f957e1a28f1a446565ff3c712d0a46daf2ede6d39b03a9c86d5bad7dd403bb83ea0ab

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-KDKGQ.tmp\msvcp140.dll
    Filesize

    427KB

    MD5

    3a207bdfaa989abab1cf5f7e86555b87

    SHA1

    b5df7c111591c9cf719260fcf0769322927f23f8

    SHA256

    9e9b340bba6d47fb15cde3b9d0568c6d296e3299eca0dfcd2bf000637b36fe13

    SHA512

    9341b5083a9f1470a2f6834d0440b04346da7f4a1b050741c3acc32af730daa567ddcd15d699b7918b7a3a83b5bc45c5514872100d820d63deb8a9b17633e54f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-KDKGQ.tmp\tier0.dll
    Filesize

    142KB

    MD5

    db894e877aa91484ec5b7075f6dfde2a

    SHA1

    779f09729789a86f5efd3e010c8cf59ad004e12f

    SHA256

    b318fb7d1cc6763c0c21684a3949b46a9316045afaa3bb6959f37678cf661f1b

    SHA512

    27cd3509cbcdae17c2c292ea900fd71a7dec762a3b6d9a65e9b6e5c791cd2e661a71ef5979044f094cb22b29d65e085732dfbf3ad69916e4d19e19e0f209d6b7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-KDKGQ.tmp\unihelp.dll
    Filesize

    100KB

    MD5

    2e279ffcc1de9027cebc97511ec4e3fa

    SHA1

    31732b05b4c02d9d0f5f8be8a0984900bc46be25

    SHA256

    915205ab28fdd2e0b5677976425b68918ea141e4ea3ddfc3dad8025d6390da64

    SHA512

    305e5a1a1e4f8545f368c72ee73515b3bb22e7a458b0e40e0f353b13959fedeadaa01f4fd05efee9554f6def66867d1696042463105bba146626543623d337ec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-KDKGQ.tmp\vcruntime140.dll
    Filesize

    75KB

    MD5

    30f437cc4598570e7cc661f8131daf2e

    SHA1

    1549c04d7babf58b71a243ce5e7ec308494ca818

    SHA256

    b48dc53977477f13ca80e7aa002d23a127b53515c0a45fe82c2a87f35450d1d0

    SHA512

    30f21fd5f884d47a46796024ceffb5ef426bbad4c81e1a5fcefe408db5af4739ddc76b18c3937b73000d288440ef886136ef96fc09611c924b20128272cb1539

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-KDKGQ.tmp\zlib.dll
    Filesize

    82KB

    MD5

    42ead533d902c09ac7c6b78eaafbc76b

    SHA1

    7ee55d69b5176b440448ef92188eb8c8c47eaf5d

    SHA256

    bd33974eacf309cdcd0bc081286fe777d95f7a97f0bfca873a4255427eac7ea1

    SHA512

    67e12c8560c22c7c073d2e4cb42840ab5c8909be3f651b7bfa681ea3161bb83ba1eadb8c7671fef0e45b02c3ca1a5f8b6fb2f636d50a30e0c9b523bf21426e27

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-UP5GD.tmp\506a508b6a6f236185fd9c2689f548c7085948ceb0e99cc8d5c7c2b81bbe80f9.tmp
    Filesize

    3.1MB

    MD5

    fac8132caa0cb6c2d3e39cbd998f06fb

    SHA1

    a4b39e7e47d241016e344bf480af553738304358

    SHA256

    7bf4f7e44c6ca207555034b4c869c638d8cc6b198a46a4875f4c64f2877c77d8

    SHA512

    dc3e236c769032eeefc688f921ad08681f91ed9eb700f463a6a7e6281696823d7aad074fa1970ce176133a8d23ca1957d54d9cf3e19f4ad98d04d5c7ac65b023

    Download Submit

  • memory/1188-0-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

    Download

  • memory/1188-2-0x0000000000401000-0x00000000004B7000-memory.dmp

    Filesize

    728KB

    Download

  • memory/1188-61-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

    Download

  • memory/2896-6-0x0000000000400000-0x0000000000724000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2896-62-0x0000000000400000-0x0000000000724000-memory.dmp

    Filesize

    3.1MB

    Download