fdd2551696ea2f0d3ee85b0087e43056cc976055be13977c9ece574a11704cfe

Analysis

max time kernel
83s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
08/06/2024, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_all/dotnet-sdk-6.0.422-win-x64.exe
Size 192.1MB
Sample240608-vvze5aee82
SHA256 898ec516835af06e04b6652ab1e8d1337bb1e560a16484baa6b5441e64b778a1
MD5 bdb1f0bc231a5db9313d31d55076a77d
SHA1 97ff04aa38fc5726aa53ec611724b1725e9e37c0
SHA512 9ef9f83eaff52145d91d48b4326bfd7926eb20b25e069461ff4f132fbe5d534e7271c719a848b5766635cdc31d0f67a4820d60438e9db5f384d1ca82a627f315
SSDEEP 3145728:H5QtBju8PhY6aFizFjsHnrxIB53tm1ozlCi6OSMW9SwArZXUYcnxe02DIU:K7n1aAjsHraBFtsogtFRSBXlDx
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
1708	dotnet-sdk-6.0.422-win-x64.exe

Loads dropped DLL 1 IoCs

pid	Process
1708	dotnet-sdk-6.0.422-win-x64.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 1708	3128	dotnet-sdk-6.0.422-win-x64.exe	75
PID 3128 wrote to memory of 1708	3128	dotnet-sdk-6.0.422-win-x64.exe	75
PID 3128 wrote to memory of 1708	3128	dotnet-sdk-6.0.422-win-x64.exe	75

C:\Users\Admin\AppData\Local\Temp\install_all\dotnet-sdk-6.0.422-win-x64.exe
"C:\Users\Admin\AppData\Local\Temp\install_all\dotnet-sdk-6.0.422-win-x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\Temp\{3D096209-A663-4121-B6A7-C1C1E5AA1FEB}\.cr\dotnet-sdk-6.0.422-win-x64.exe
  "C:\Windows\Temp\{3D096209-A663-4121-B6A7-C1C1E5AA1FEB}\.cr\dotnet-sdk-6.0.422-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\install_all\dotnet-sdk-6.0.422-win-x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=552
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dotnet-sdk-6.0.422-win-x64.exe

Path C:\Windows\Temp\{3D096209-A663-4121-B6A7-C1C1E5AA1FEB}\.cr\dotnet-sdk-6.0.422-win-x64.exe
Size 610KB
SHA256 47316c4be2f2064a7dd99a7874a71c9f944fa06038d5a9eab75171ba8fdc7381
MD5 a77f2155ca9230a300d75c35f73659f9
SHA1 67193e58e5e1cdfe43a2a0eebfa2c0eb917c352e
SHA512 5e91d9dd52cad1676abe8b5a752a54d78f13903da55137106427f2516aa6c068475010e523efbca8e374024ae3769b0362adafe0313963903d2474d068b6b7ca
SSDEEP 12288:E5mWukhI2jFMSjysAS9X/GsfTDYrGiob+BrCWPv2k0Bo2AtNOvyIZW1Uvps:E5mWpI2jFM5sFzfTpi8+ZPdYo24QvG
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg.png

Path C:\Windows\Temp\{5EB94453-2C97-4272-8D18-3D250E5E88AD}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
MD5 SHA1 SHA512 SSDEEP

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{5EB94453-2C97-4272-8D18-3D250E5E88AD}\.ba\wixstdba.dll
Size 197KB
SHA256 41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104
MD5 4356ee50f0b1a878e270614780ddf095
SHA1 b5c0915f023b2e4ed3e122322abc40c4437909af
SHA512 b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691
SSDEEP 3072:4Fj2AYmaHqco56wsPZozShZTjVORuXzv7x5Okw7QWwF4QUdPArtOuw6meOlONtZz:4Fj2ARaKaPZ3TjcAR5OflbQ7tOzKh40V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads