714be04f5a4a1bc43ee8347bdbc83d6d6ed5d9bd32bf8c59fa5ef49408052376

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
714be04f5a4a1bc43ee8347bdbc83d6d6ed5d9bd32bf8c59fa5ef49408052376.exe
Size 1.0MB
Sample240607-bc6a6seg81
SHA256 714be04f5a4a1bc43ee8347bdbc83d6d6ed5d9bd32bf8c59fa5ef49408052376
MD5 dcaceae40f4065716ef624103dbff156
SHA1 aa9324eeb19d73c8899f8cbd043be48eacfa20c3
SHA512 49861d92f5d501a8b67fbb0222f0cda54f0dde125d17afa87ce5926b4dbbd1892dd41c11c10acb2c0c1c72a99f1f6738b8cb1b6ffa4375f7133635df201ecda8
SSDEEP 6144:6uj8NDF3OR9/Qe2HdJ8pS4ofWdii6Qr0ln:FOF3ORK3d14ofWdii9r0ln
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Signatures

Detects executables packed with ASPack 5 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023289-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1780-11-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3100-7-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0007000000023413-13.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0007000000023415-25.dat	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 11 IoCs

pid	Process
3100	casino_extensions.exe
736	Casino_ext.exe
884	casino_extensions.exe
604	Casino_ext.exe
396	casino_extensions.exe
1092	Casino_ext.exe
744	casino_extensions.exe
2484	Casino_ext.exe
2100	LiveMessageCenter.exe
2880	casino_extensions.exe
2516	Casino_ext.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	LiveMessageCenter.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File created	C:\Program Files (x86)\Internet Explorer\$$202803s.bat	casino_extensions.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
736	Casino_ext.exe
736	Casino_ext.exe
604	Casino_ext.exe
604	Casino_ext.exe
1092	Casino_ext.exe
1092	Casino_ext.exe
2484	Casino_ext.exe
2484	Casino_ext.exe
2100	LiveMessageCenter.exe
2100	LiveMessageCenter.exe
2516	Casino_ext.exe
2516	Casino_ext.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1780	714be04f5a4a1bc43ee8347bdbc83d6d6ed5d9bd32bf8c59fa5ef49408052376.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 516	1780	714be04f5a4a1bc43ee8347bdbc83d6d6ed5d9bd32bf8c59fa5ef49408052376.exe	82
PID 1780 wrote to memory of 516	1780	714be04f5a4a1bc43ee8347bdbc83d6d6ed5d9bd32bf8c59fa5ef49408052376.exe	82
PID 1780 wrote to memory of 516	1780	714be04f5a4a1bc43ee8347bdbc83d6d6ed5d9bd32bf8c59fa5ef49408052376.exe	82
PID 516 wrote to memory of 3100	516	casino_extensions.exe	83
PID 516 wrote to memory of 3100	516	casino_extensions.exe	83
PID 516 wrote to memory of 3100	516	casino_extensions.exe	83
PID 3100 wrote to memory of 736	3100	casino_extensions.exe	84
PID 3100 wrote to memory of 736	3100	casino_extensions.exe	84
PID 3100 wrote to memory of 736	3100	casino_extensions.exe	84
PID 736 wrote to memory of 1432	736	Casino_ext.exe	85
PID 736 wrote to memory of 1432	736	Casino_ext.exe	85
PID 736 wrote to memory of 1432	736	Casino_ext.exe	85
PID 1432 wrote to memory of 884	1432	casino_extensions.exe	86
PID 1432 wrote to memory of 884	1432	casino_extensions.exe	86
PID 1432 wrote to memory of 884	1432	casino_extensions.exe	86
PID 884 wrote to memory of 604	884	casino_extensions.exe	87
PID 884 wrote to memory of 604	884	casino_extensions.exe	87
PID 884 wrote to memory of 604	884	casino_extensions.exe	87
PID 604 wrote to memory of 2300	604	Casino_ext.exe	88
PID 604 wrote to memory of 2300	604	Casino_ext.exe	88
PID 604 wrote to memory of 2300	604	Casino_ext.exe	88
PID 2300 wrote to memory of 396	2300	casino_extensions.exe	89
PID 2300 wrote to memory of 396	2300	casino_extensions.exe	89
PID 2300 wrote to memory of 396	2300	casino_extensions.exe	89
PID 396 wrote to memory of 1092	396	casino_extensions.exe	90
PID 396 wrote to memory of 1092	396	casino_extensions.exe	90
PID 396 wrote to memory of 1092	396	casino_extensions.exe	90
PID 1092 wrote to memory of 2132	1092	Casino_ext.exe	91
PID 1092 wrote to memory of 2132	1092	Casino_ext.exe	91
PID 1092 wrote to memory of 2132	1092	Casino_ext.exe	91
PID 2132 wrote to memory of 744	2132	casino_extensions.exe	92
PID 2132 wrote to memory of 744	2132	casino_extensions.exe	92
PID 2132 wrote to memory of 744	2132	casino_extensions.exe	92
PID 744 wrote to memory of 2484	744	casino_extensions.exe	93
PID 744 wrote to memory of 2484	744	casino_extensions.exe	93
PID 744 wrote to memory of 2484	744	casino_extensions.exe	93
PID 2484 wrote to memory of 3720	2484	Casino_ext.exe	94
PID 2484 wrote to memory of 3720	2484	Casino_ext.exe	94
PID 2484 wrote to memory of 3720	2484	Casino_ext.exe	94
PID 3720 wrote to memory of 2100	3720	casino_extensions.exe	95
PID 3720 wrote to memory of 2100	3720	casino_extensions.exe	95
PID 3720 wrote to memory of 2100	3720	casino_extensions.exe	95
PID 2100 wrote to memory of 4064	2100	LiveMessageCenter.exe	96
PID 2100 wrote to memory of 4064	2100	LiveMessageCenter.exe	96
PID 2100 wrote to memory of 4064	2100	LiveMessageCenter.exe	96
PID 4064 wrote to memory of 2880	4064	casino_extensions.exe	97
PID 4064 wrote to memory of 2880	4064	casino_extensions.exe	97
PID 4064 wrote to memory of 2880	4064	casino_extensions.exe	97
PID 2880 wrote to memory of 2516	2880	casino_extensions.exe	98
PID 2880 wrote to memory of 2516	2880	casino_extensions.exe	98
PID 2880 wrote to memory of 2516	2880	casino_extensions.exe	98
PID 2516 wrote to memory of 456	2516	Casino_ext.exe	99
PID 2516 wrote to memory of 456	2516	Casino_ext.exe	99
PID 2516 wrote to memory of 456	2516	Casino_ext.exe	99
PID 456 wrote to memory of 3312	456	casino_extensions.exe	100
PID 456 wrote to memory of 3312	456	casino_extensions.exe	100
PID 456 wrote to memory of 3312	456	casino_extensions.exe	100

C:\Users\Admin\AppData\Local\Temp\714be04f5a4a1bc43ee8347bdbc83d6d6ed5d9bd32bf8c59fa5ef49408052376.exe
"C:\Users\Admin\AppData\Local\Temp\714be04f5a4a1bc43ee8347bdbc83d6d6ed5d9bd32bf8c59fa5ef49408052376.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\SysWOW64\casino_extensions.exe
    C:\Windows\system32\casino_extensions.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\SysWOW64\Casino_ext.exe
      C:\Windows\SysWOW64\Casino_ext.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:736
    - - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1432
      - C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:884
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:604
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        8⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        9⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        11⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        12⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:744
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        13⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        14⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe /part2
        15⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        16⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        17⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        18⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        19⤵
        Drops file in System32 directory
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c $$2028~1.BAT
        20⤵
        
        PID:3312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

$$202803s.bat

Path C:\Program Files (x86)\Internet Explorer\$$202803s.bat
Size 81B
SHA256 c08018226d9a45ab277a01ca35f519ff7ea1cb450d080e24b0f590739654241d
MD5 4777bf695815d870d27ed4a38a8f0840
SHA1 565412b5182bca7a221448dba78369c42d1c4a0c
SHA512 87e792d326c5a9d2d92984ec4c34d2af9d616a4676a7d69df73b09975fd077d96077ae2528b6fc05752110eb4e406c3e9d94d49d0a74eeaba6bc6a48bca8ac1d
MD5 SHA1 SHA512

Submit Download

LiveMessageCenter.exe

Path C:\Windows\SysWOW64\LiveMessageCenter.exe
Size 1.0MB
SHA256 7fda71dc256635b7b20ef1b4347a7a8249069d08ba3068132c7044d6de12f619
MD5 958d5bd5a31ec9a52efee9ded3dd3397
SHA1 d7f6337361c52216ab564e7e6402b74258573377
SHA512 294e6f19c1a4a5df63929fc14f95bdb0c25382a0babe0de56785f38d5032867dd7f55215d6cfb3e4c1efa9ecff67280a62004b39a43c07a41e01f6a8be116d6c
SSDEEP 6144:Auj8NDF3OR9/Qe2HdJ8pS4ofWdii6Qr0lC:rOF3ORK3d14ofWdii9r0lC
MD5 SHA1 SHA512 SSDEEP

Submit Download

casino_extensions.exe

Path C:\Windows\SysWOW64\casino_extensions.exe
Size 1.0MB
SHA256 af535f7f237a0c86315148f09a0bed53531a80690d900c482689131c463eb382
MD5 63700edb0252715ef660c8c945d24b96
SHA1 5e1c6d81592a279496e01e69cca4933ebce2af8f
SHA512 25d628c5afc0ac84b6ec80bd4204a77d1ab92e487af5b9581e88cdf9c682a73f8dd375c7a5236c1d64807a440ccb27437f1984f492b3fdca6f03fae4c28792a8
SSDEEP 6144:Duj8NDF3OR9/Qe2HdJ8pS4ofWdii6Qr0lMH:iOF3ORK3d14ofWdii9r0lMH
MD5 SHA1 SHA512 SSDEEP

Submit Download

casino_extensions.exe

Path C:\Windows\SysWOW64\casino_extensions.exe
Size 1.0MB
SHA256 9f00a6b92fa3c0c953c7231f510bbb26743b198e6833762a492d789e7eb207fb
MD5 13abf31457ad8c250da7fb9be4778d1d
SHA1 3b4470c2910e4d4f2f4f6a66785aaf0cb471cefa
SHA512 8d5e3f2799851e056312c86fb7611a7678c5b0629dbf2910b087fb42d70ae57329095ee14a8ecfa6b2d197c8408bbe7d345e3817095402a40928725ce1e105a4
SSDEEP 6144:Ruj8NDF3OR9/Qe2HdJ8pS4ofWdii6Qr0lW:AOF3ORK3d14ofWdii9r0lW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1780-11-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3100-7-0x0000000000400000-0x0000000000424000-memory.dmp

Download