Resubmissions

19-06-2024 13:34

240619-qvbxls1emc 7

19-06-2024 13:31

240619-qsva6s1eke 7

Analysis

  • max time kernel
    359s
  • max time network
    360s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 13:34

General

  • Target

    DBDRegion.exe

  • Size

    41.5MB

  • MD5

    b4bce706f30f163ff0f69473cca0fdc1

  • SHA1

    73e65353f5462cc33626af20f79aea5c28eff4a5

  • SHA256

    ed560ef0e071cfe478013a2271639babca95148796e8dcb01b10ac5ef671f691

  • SHA512

    e0674aa33738da307db6ee489e5a10c961480ba0ea8d0eb222389fae7764ccc0ab4b8e6b834adc172a0c7da64730481c28ef72771fc15b7f4044e88a257bd9cf

  • SSDEEP

    786432:m+gX4BMdhwzTQXR5FbPp3CYFcSS5U/LT2KzVyPVL9jvOVhQX93tq38j:EXGMK4XR3b9CHSCU/+6yPlhv+hQXg8

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DBDRegion.exe
    "C:\Users\Admin\AppData\Local\Temp\DBDRegion.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Local\Temp\DBDRegion.exe
      "C:\Users\Admin\AppData\Local\Temp\DBDRegion.exe"
      2⤵
      • Loads dropped DLL
      PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-file-l1-2-0.dll

    Filesize

    18KB

    MD5

    49c3ffd47257dbcb67a6be9ee112ba7f

    SHA1

    04669214375b25e2dc8a3635484e6eeb206bc4eb

    SHA256

    322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165

    SHA512

    bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98

  • C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-file-l2-1-0.dll

    Filesize

    18KB

    MD5

    bfffa7117fd9b1622c66d949bac3f1d7

    SHA1

    402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

    SHA256

    1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

    SHA512

    b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

  • C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    20KB

    MD5

    588bd2a8e0152e0918742c1a69038f1d

    SHA1

    9874398548891f6a08fc06437996f84eb7495783

    SHA256

    a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094

    SHA512

    32ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f

  • C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    18KB

    MD5

    d699333637db92d319661286df7cc39e

    SHA1

    0bffb9ed366853e7019452644d26e8e8f236241b

    SHA256

    fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504

    SHA512

    6fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51

  • C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    18KB

    MD5

    f62b66f451f2daa8410ad62d453fa0a2

    SHA1

    4bf13db65943e708690d6256d7ddd421cc1cc72b

    SHA256

    48eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720

    SHA512

    d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419

  • C:\Users\Admin\AppData\Local\Temp\_MEI22082\python310.dll

    Filesize

    4.5MB

    MD5

    efe2d90cc0e7b8741109513e28bcd62a

    SHA1

    0f3076290f70a3b6646376a48a95709b1967f8d7

    SHA256

    b174d52c48323281b4c71881b77e67c7b38a430b9ee3e1c33ed8468eb80cce37

    SHA512

    6051a1b244f6980030cec4408480f8f910770ae0f1122fe1f8a373add76fce63acaae987889c65587939a769ba07aa62c9aadbb396cab6b648fa4d25e179fcb7

  • C:\Users\Admin\AppData\Local\Temp\_MEI22082\ucrtbase.dll

    Filesize

    992KB

    MD5

    0e0bac3d1dcc1833eae4e3e4cf83c4ef

    SHA1

    4189f4459c54e69c6d3155a82524bda7549a75a6

    SHA256

    8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

    SHA512

    a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd