6feaf0b5d0a265687c41284286c03b9160833880b77eda231513b3d36b2ab73d

Analysis

max time kernel
135s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Visual-C++/vcredist2008_x86.exe
Size

4.3MB
MD5

35da2bf2befd998980a495b6f4f55e60
SHA1

470640aa4bb7db8e69196b5edb0010933569e98d
SHA256

6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
SHA512

bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
SSDEEP

98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

install.exe

pid process

3220 install.exe
Loads dropped DLL 1 IoCs

Processes:

install.exe

pid process

3220 install.exe

pid	process
3220	install.exe

pid	process
3220	install.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

vcredist2008_x86.exe

description	pid	process	target process
PID 1448 wrote to memory of 3220	1448	vcredist2008_x86.exe	install.exe
PID 1448 wrote to memory of 3220	1448	vcredist2008_x86.exe	install.exe
PID 1448 wrote to memory of 3220	1448	vcredist2008_x86.exe	install.exe

C:\Users\Admin\AppData\Local\Temp\Visual-C++\vcredist2008_x86.exe
"C:\Users\Admin\AppData\Local\Temp\Visual-C++\vcredist2008_x86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448

\??\c:\3dedf157829421235b9ec3bc3b02\install.exe
c:\3dedf157829421235b9ec3bc3b02\.\install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\3dedf157829421235b9ec3bc3b02\install.exe

Filesize
547KB

MD5
4138c31964fbcb3b7418e086933324c3

SHA1
97cc6f58fb064ab6c4a2f02fb665fef77d30532f

SHA256
b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29

SHA512
40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557

Download Submit
\??\c:\3dedf157829421235b9ec3bc3b02\globdata.ini

Filesize
1KB

MD5
0a6b586fabd072bd7382b5e24194eac7

SHA1
60e3c7215c1a40fbfb3016d52c2de44592f8ca95

SHA256
7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

SHA512
b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

Download Submit
\??\c:\3dedf157829421235b9ec3bc3b02\install.ini

Filesize
841B

MD5
f8f6c0e030cb622f065fe47d61da91d7

SHA1
cf6fa99747de8f35c6aea52df234c9c57583baa3

SHA256
c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d

SHA512
b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde

Download Submit
\??\c:\3dedf157829421235b9ec3bc3b02\install.res.1033.dll

Filesize
85KB

MD5
ff6003014eefc9c30abe20e3e1f5fbe8

SHA1
4a5bd05f94545f01efc10232385b8fecad300678

SHA256
a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067

SHA512
3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2

Download Submit
\??\c:\3dedf157829421235b9ec3bc3b02\vc_red.msi

Filesize
222KB

MD5
7e641e6a0b456271745c20c3bb8a18f9

SHA1
ae6cedcb81dc443611a310140ae4671789dbbf3a

SHA256
34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d

SHA512
f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903

Download Submit
\??\c:\3dedf157829421235b9ec3bc3b02\vcredist.bmp

Filesize
5KB

MD5
06fba95313f26e300917c6cea4480890

SHA1
31beee44776f114078fc403e405eaa5936c4bc3b

SHA256
594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1

SHA512
7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd

Download Submit
memory/3220-33-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/3220-36-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download