29fbbdb392bbbd33f9b905d37868e9d379e0f3eea0777939c42d9e2877f250bb

General

Target

29fbbdb392bbbd33f9b905d37868e9d379e0f3eea0777939c42d9e2877f250bb.exe
Size

5.0MB
MD5

b49a2bf6b7e1f66880eb1f370266955a
SHA1

a7e0eb86e23b971c504be4a786c40f127f7398ff
SHA256

29fbbdb392bbbd33f9b905d37868e9d379e0f3eea0777939c42d9e2877f250bb
SHA512

b9aee1f61e201e620582ba44750aeb034483a92239f096035bc92c6009112ae378de2d4338ebc0c195b53ad2f18c8c31186797a476ef9a1e41aca61af8990800
SSDEEP

24576:i9Hs4MROxnF95bYmfFhQYrZlI0AilFEvxHi3e:qH/MiKYrZlI0AilFEvxHi

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	29fbbdb392bbbd33f9b905d37868e9d379e0f3eea0777939c42d9e2877f250bb.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	29fbbdb392bbbd33f9b905d37868e9d379e0f3eea0777939c42d9e2877f250bb.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	29fbbdb392bbbd33f9b905d37868e9d379e0f3eea0777939c42d9e2877f250bb.exe
File created	C:\Windows\assembly\Desktop.ini	29fbbdb392bbbd33f9b905d37868e9d379e0f3eea0777939c42d9e2877f250bb.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	29fbbdb392bbbd33f9b905d37868e9d379e0f3eea0777939c42d9e2877f250bb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 2276	4512	29fbbdb392bbbd33f9b905d37868e9d379e0f3eea0777939c42d9e2877f250bb.exe	86
PID 4512 wrote to memory of 2276	4512	29fbbdb392bbbd33f9b905d37868e9d379e0f3eea0777939c42d9e2877f250bb.exe	86
PID 2276 wrote to memory of 1100	2276	csc.exe	88
PID 2276 wrote to memory of 1100	2276	csc.exe	88

C:\Users\Admin\AppData\Local\Temp\29fbbdb392bbbd33f9b905d37868e9d379e0f3eea0777939c42d9e2877f250bb.exe
"C:\Users\Admin\AppData\Local\Temp\29fbbdb392bbbd33f9b905d37868e9d379e0f3eea0777939c42d9e2877f250bb.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3qga5hek.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7FFE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7FFD.tmp"
    3⤵
    PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3qga5hek.dll

Filesize
76KB

MD5
fb8d15f898b0d5e183875a10189604f6

SHA1
27d0793d2284a13cd0d3567623932eadb9109a67

SHA256
da171bddf2def47d06a3fa5b3c43d3bfed07df5994618543432811ba6f90315c

SHA512
badf58f5c4c47f7ffda15055bb90efdc1b1e798b8ef1549322249bdbfa6505ce9b2246ad3d75d54bb64aa34e42f9ac3b288a042a723e549bfbce4eb1cbaa7374

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7FFE.tmp

Filesize
1KB

MD5
72b5129a5667d022d3d7e890ec6e3e79

SHA1
fafdfb6187f2ea272a687864b07b23ae5fbdbaba

SHA256
6e6a372f93415f4b38aa4806c19967a5c9bb5e8f69264c627476ce5ee12726a9

SHA512
59b6d7e744a7968d8fde54a69bf63b750b1b8fdd3d16e3d87ae6a7302f7e9e666a8a8526fc967304d3b1cdb9dff4569a7e82ebe46f412378d695686bfeb07f30

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3qga5hek.0.cs

Filesize
208KB

MD5
c941e8e46f131c8d6161dbab1ad63cf4

SHA1
feb1b74d4c9e4c7c035762b2e3d8698fb1c9b641

SHA256
61fd97c2c23b2bcecbccaeb264a474572e81afc2cd126f5bc05a4b349fdaa8c2

SHA512
9a3ef11054286a55a232d0f540d5800fb506c756a7e012aac6e82ab2a4cc58f8c7aae989d4027b284e69341dc64b76fa8f09f58bc9508614eec65b58755836de

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3qga5hek.cmdline

Filesize
349B

MD5
0df975eec45a00ccd0d15f784143207c

SHA1
e2571b4c060b65668de1a1e392156284f9672289

SHA256
85e56f080cdba286eeb66868437da1758a7d65dcb99f44e6ab60d6006bdaab2e

SHA512
0f00cc8a8cebdb3d93d5ccb5666c288c3c8d8841bc39408b4704c98804441a517d33d84c64a6049153b769958ee058249c8f58fdcc020ef1b5fe991a8741f4dd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC7FFD.tmp

Filesize
676B

MD5
729455d588e6a04d49f63c63b28c9060

SHA1
63f5d6851de77a16b6155c1e88401edb4b4a6063

SHA256
152d3e3611039243ee084cb07245d416c971ea9aaff04aaf61db2ad3dfbe4ffd

SHA512
bf97c7cffe1e7e6436417b20f9a5a624ead9f054b309109b918c0c765bd2482d635bc14b7e6c36c5ddf777d7db8e3f30d609ba6d6ae32207ba8119217f36c25a

Download Submit
memory/2276-21-0x00007FFD078C0000-0x00007FFD08261000-memory.dmp

Filesize
9.6MB

Download
memory/2276-16-0x00007FFD078C0000-0x00007FFD08261000-memory.dmp

Filesize
9.6MB

Download
memory/4512-23-0x000000001C880000-0x000000001C896000-memory.dmp

Filesize
88KB

Download
memory/4512-28-0x000000001CC60000-0x000000001CCC2000-memory.dmp

Filesize
392KB

Download
memory/4512-7-0x00007FFD078C0000-0x00007FFD08261000-memory.dmp

Filesize
9.6MB

Download
memory/4512-6-0x000000001BC80000-0x000000001C14E000-memory.dmp

Filesize
4.8MB

Download
memory/4512-5-0x000000001B760000-0x000000001B76E000-memory.dmp

Filesize
56KB

Download
memory/4512-2-0x000000001B580000-0x000000001B5DC000-memory.dmp

Filesize
368KB

Download
memory/4512-1-0x00007FFD078C0000-0x00007FFD08261000-memory.dmp

Filesize
9.6MB

Download
memory/4512-0-0x00007FFD07B75000-0x00007FFD07B76000-memory.dmp

Filesize
4KB

Download
memory/4512-25-0x000000001B4D0000-0x000000001B4E2000-memory.dmp

Filesize
72KB

Download
memory/4512-26-0x0000000000F80000-0x0000000000F88000-memory.dmp

Filesize
32KB

Download
memory/4512-27-0x000000001B560000-0x000000001B568000-memory.dmp

Filesize
32KB

Download
memory/4512-8-0x000000001C1F0000-0x000000001C28C000-memory.dmp

Filesize
624KB

Download
memory/4512-29-0x000000001D5D0000-0x000000001DB8A000-memory.dmp

Filesize
5.7MB

Download
memory/4512-30-0x000000001DB90000-0x000000001DC80000-memory.dmp

Filesize
960KB

Download
memory/4512-31-0x000000001CDC0000-0x000000001CDDE000-memory.dmp

Filesize
120KB

Download
memory/4512-32-0x000000001DC90000-0x000000001DCD9000-memory.dmp

Filesize
292KB

Download
memory/4512-33-0x00007FFD078C0000-0x00007FFD08261000-memory.dmp

Filesize
9.6MB

Download
memory/4512-34-0x000000001DD70000-0x000000001DDE0000-memory.dmp

Filesize
448KB

Download
memory/4512-35-0x00007FFD078C0000-0x00007FFD08261000-memory.dmp

Filesize
9.6MB

Download
memory/4512-37-0x000000001C8B0000-0x000000001C8B8000-memory.dmp

Filesize
32KB

Download
memory/4512-38-0x00007FFD07B75000-0x00007FFD07B76000-memory.dmp

Filesize
4KB

Download
memory/4512-39-0x00007FFD078C0000-0x00007FFD08261000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads