Analysis

  • max time kernel
    135s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 01:14

General

  • Target

    $TEMP/123.exe

  • Size

    238KB

  • MD5

    eb18db4401a41b7643dc2d20cd311a21

  • SHA1

    f86498dbd02816979b4ca272b7f916e8f62e3c43

  • SHA256

    aae2deac33f1548e95295238f4bd83af39a4abe7904f0455f1f7ecfd213a196f

  • SHA512

    51b0a4419970bb1191694b5708a82ccb96e587954a77f19345ee95b8d2ffe9205fd13da747b4da76094b84c608f3d5bac56eb650d8f5d8a1888e57a0d90ae135

  • SSDEEP

    6144:LhF2fYHipbBER+iH3vIEuiAvxJsKW4nflzxhRghOisOe:lUnRqgwvBu5wKvflFfiG

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 31 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    PID:3148
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 740
      2⤵
      • Program crash
      PID:3520
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3148 -ip 3148
    1⤵
      PID:3704

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\baidu\bar\BDBar_tmp\BaiduBar.dll

      Filesize

      584KB

      MD5

      0c8ed82bce60e5e2860d9daa28289267

      SHA1

      5ea9dcfadc426463c51e0abfc736a42dfc31f3e9

      SHA256

      89bc3949eb1ab805b49f2699f0623796997ba7bf0f5acf9402f90ae5cd630d13

      SHA512

      2a6b90d1ee12d88a9866b774de5b52b329beebbb9ce0c1655455020aeaddd0824cd3c38804e76f777b81fa5b149744b392ea8f904ba2eb71c6db779a0ef85830

    • memory/3148-16-0x00000000021F0000-0x000000000228C000-memory.dmp

      Filesize

      624KB