Resubmissions

09/06/2024, 08:44

240609-knmgwagc4s 3

09/06/2024, 08:31

240609-kexw9agb5x 7

Analysis

  • max time kernel
    62s
  • max time network
    69s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 08:31

General

  • Target

    @prvpane - X2 2020/▷ Necessary Downloads (for X2 to work)/VC_redist.x86.exe

  • Size

    13.1MB

  • MD5

    1fb0faba3d602afe03740db3d145c1e6

  • SHA1

    2c1ae47103e7f8d6072df4a8d9ceb382724ac59b

  • SHA256

    1acd8d5ea1cdc3eb2eb4c87be3ab28722d0825c15449e5c9ceef95d897de52fa

  • SHA512

    4509cfbd5f08cc32d68855edc285e8ba8caa7d2c4d044e4256dd907b205fda9a689c32ad7ef9ff3955e8390ed67498a54039a3cd4bfc9102ed82f9bd1255011a

  • SSDEEP

    196608:xRjxHvflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4Q/gVMMrXF/OMsjCEJy4ErENIhf:bxHHlptVYmfr7yBG/459OM+CC6T2sFb

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\@prvpane - X2 2020\▷ Necessary Downloads (for X2 to work)\VC_redist.x86.exe
    "C:\Users\Admin\AppData\Local\Temp\@prvpane - X2 2020\▷ Necessary Downloads (for X2 to work)\VC_redist.x86.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4392
    • C:\Windows\Temp\{6EE2C43E-861E-422C-B0FB-08E1B7382DE9}\.cr\VC_redist.x86.exe
      "C:\Windows\Temp\{6EE2C43E-861E-422C-B0FB-08E1B7382DE9}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\@prvpane - X2 2020\▷ Necessary Downloads (for X2 to work)\VC_redist.x86.exe" -burn.filehandle.attached=536 -burn.filehandle.self=532
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Temp\{6EE2C43E-861E-422C-B0FB-08E1B7382DE9}\.cr\VC_redist.x86.exe

    Filesize

    632KB

    MD5

    1636039e4940c80acaeb369852f79cef

    SHA1

    7d2b5110d1bf729d7fcd9e42a2b01a58dcc66a69

    SHA256

    d116ecd1f04402430eb8ff5e07357f7ab2a2e0aa12dd6c5156e7f92705568e0e

    SHA512

    3ba5c3225b74594d6121a45f225204e8eb4b80afc60849fe78a933afcc81f8db7221cdcbe5789ade1b3f2d784dc3659c08692f7bd808b85198cb78e601d8da02

  • C:\Windows\Temp\{EB7FE9BC-9972-4D9F-8812-38A405E7119C}\.ba\logo.png

    Filesize

    1KB

    MD5

    d6bd210f227442b3362493d046cea233

    SHA1

    ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

    SHA256

    335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

    SHA512

    464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

  • C:\Windows\Temp\{EB7FE9BC-9972-4D9F-8812-38A405E7119C}\.ba\wixstdba.dll

    Filesize

    191KB

    MD5

    eab9caf4277829abdf6223ec1efa0edd

    SHA1

    74862ecf349a9bedd32699f2a7a4e00b4727543d

    SHA256

    a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

    SHA512

    45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2