7b1712a8fd75f73f3a807f858f596f168ee206672063922ee07351b0b097cb72

Analysis

max time kernel
21s
max time network
16s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 11:19

Target

AIM-Stealer-setup.exe
Size

14.5MB
MD5

8db1ca3f184b9e4a7188bed23e905def
SHA1

bda45770765e9d8b18991d3d336f744424af5348
SHA256

7b1712a8fd75f73f3a807f858f596f168ee206672063922ee07351b0b097cb72
SHA512

c02cd44fd8d071fa8d900e7b5570c0457f659039351d6c6f28eea5f8a722864e98638984d6a1ca726395638f39ad6bf834f98f96cc5a05b058e85139d91b45c6
SSDEEP

196608:1x4yTpOa464P29qoWuW4zOvspc9Jaa/segGltJ71wI5fua3fkVZ8ref:1xwa4P291M1UIX/zgGlb/5KZb

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2372	AIM-Stealer-setup.tmp

Loads dropped DLL 1 IoCs

pid	Process
2228	AIM-Stealer-setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2372	2228	AIM-Stealer-setup.exe	28
PID 2228 wrote to memory of 2372	2228	AIM-Stealer-setup.exe	28
PID 2228 wrote to memory of 2372	2228	AIM-Stealer-setup.exe	28
PID 2228 wrote to memory of 2372	2228	AIM-Stealer-setup.exe	28
PID 2228 wrote to memory of 2372	2228	AIM-Stealer-setup.exe	28
PID 2228 wrote to memory of 2372	2228	AIM-Stealer-setup.exe	28
PID 2228 wrote to memory of 2372	2228	AIM-Stealer-setup.exe	28

C:\Users\Admin\AppData\Local\Temp\AIM-Stealer-setup.exe
"C:\Users\Admin\AppData\Local\Temp\AIM-Stealer-setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\is-55MSF.tmp\AIM-Stealer-setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-55MSF.tmp\AIM-Stealer-setup.tmp" /SL5="$30142,14179372,724480,C:\Users\Admin\AppData\Local\Temp\AIM-Stealer-setup.exe"
  2⤵
  - Executes dropped EXE
  PID:2372

\Users\Admin\AppData\Local\Temp\is-55MSF.tmp\AIM-Stealer-setup.tmp

Filesize
2.9MB

MD5
ff8ad37aa27f76777f07a109ab739400

SHA1
2f76cb371c1fe7f058869670c622e880b3748090

SHA256
b98f9238f782ef19d7c5a119bc830a554baa128a1b97c28d0988f152f9d02635

SHA512
d54eb5f756d15ed0bdd770f424423ba5d5c3892db90932c1fe3374cd93f7a97941092eb704e5c4c2ee85097f9c60c28b19fc21d6f97844213bca3ad2722c617a

Download Submit
memory/2228-2-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download
memory/2228-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2228-10-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2372-8-0x0000000000400000-0x00000000006F2000-memory.dmp

Filesize
2.9MB

Download
memory/2372-11-0x0000000000400000-0x00000000006F2000-memory.dmp

Filesize
2.9MB

Download