116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c

General

Target

116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c.exe
Size

70.0MB
MD5

9384fc87b1b8950dae046d3429248017
SHA1

f9e1a45fc09d11d40fba13b4060856b3bcc89e39
SHA256

116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c
SHA512

8b47c006c8ce9f90d8a46e1707993477520cabb814b734b52b87256c84e106c0a0e615d1e3c9bb38dfb01e8de56e542944270a90be68318e77660dbc338f3f34
SSDEEP

24576:Q9Hs4MROxnF95bYmfFhQhrZlI0AilFEvxHiDJ:IH/MiKhrZlI0AilFEvxHi

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

Processes:

116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c.exe

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c.exe
File created	C:\Windows\assembly\Desktop.ini	116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c.exe

Drops file in Windows directory 3 IoCs

Processes:

116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c.exe

description	ioc	Process
File opened for modification	C:\Windows\assembly	116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c.exe
File created	C:\Windows\assembly\Desktop.ini	116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c.execsc.exe

description	pid	Process	procid_target
PID 3232 wrote to memory of 4012	3232	116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c.exe	87
PID 3232 wrote to memory of 4012	3232	116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c.exe	87
PID 4012 wrote to memory of 5028	4012	csc.exe	89
PID 4012 wrote to memory of 5028	4012	csc.exe	89

C:\Users\Admin\AppData\Local\Temp\116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c.exe
"C:\Users\Admin\AppData\Local\Temp\116ffac45f9bd4ba42fcd8910c4fc3fa7502eccf957e7712f8d39dd4903df26c.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fizlmglt.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA401.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA400.tmp"
    3⤵
    PID:5028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESA401.tmp

Filesize
1KB

MD5
640700c8455075fdf9c87bc262599c34

SHA1
6fc38048c9fe3c4fe0f0223d4c66474e6667a5f4

SHA256
51da1d629553abcdb59184af0eb347fc5d8ca0eb0411026f2d2bdd01c86e298f

SHA512
1e196ec09df9899586eb80c698049e8eff69a15d1d06581905620d100a8e003545ce8ddaf101dc621c1404096a260185023196cd6a7bf09bfb8b58b620562f15

Download Submit
C:\Users\Admin\AppData\Local\Temp\fizlmglt.dll

Filesize
76KB

MD5
6f6fb3e1f9fd621217c240d5bbcc3034

SHA1
a25e8fc1d488b0ae9c38b517c084429d43c4f7d1

SHA256
689e7047dfc555ebacb2ef6902c0b97621fe45a0e9fb142718a430f958cf4be0

SHA512
3996fa5fb369c866a9b88bd934d330748974661add3b98df93b930885952f25e69be854639320ddc326971a0c18cc12b907b1081d54047f353ec11eb7639092c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCA400.tmp

Filesize
676B

MD5
7c1cb68e127e2d4094ce04a8d6a2d965

SHA1
aadef8918c42ecdd08d0297255cb390ec88862d6

SHA256
4d5f37cac4a159cbaf5c85fcfcead16d843c1a855db4fc826276ef2b19929a23

SHA512
78e5351386d1404a1d9ec46e4afd60579bfef0dd9292eea08879325466ff565529ce16acb242d9ef79e7938fe918551f6bcabbd8c79867c7757f7755f0836447

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fizlmglt.0.cs

Filesize
208KB

MD5
d2f835edc893e31d68d71de27be5cd01

SHA1
b3b3e814f19dbf91ba0e8740bf23da43a474406c

SHA256
e1bb35ba40ce554ccfeedc5f227e7f68c631616e415240eba8d637380f7b0afb

SHA512
0939f3e6d9723c59eef248086d7ce13751cf9b8c30f8b21aa37ba97ae2989644bb5c2840f13e224c104ab493c35a8de4a1450cac35d0ad21a17cd1518fa50b9a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fizlmglt.cmdline

Filesize
349B

MD5
f79a45d75b1b8fed7d57f7118082a28f

SHA1
141dbed55ba57b81ec3120a2b1c7ba8f871f8b79

SHA256
b3f8f7f8be6be5753311ec09941969279a6490b5a8a719e36b996b0cceea479a

SHA512
fbc0b296577ef8af20d2c17bf73e48d599e57daf2bda0d40ffc1ec12dd69223c51cb25dd4871cc6fc69c419afe3c369b6e4e585338dc88b8ceffd82fbde8dac8

Download Submit
memory/3232-23-0x000000001CD00000-0x000000001CD16000-memory.dmp

Filesize
88KB

Download
memory/3232-26-0x0000000001400000-0x0000000001408000-memory.dmp

Filesize
32KB

Download
memory/3232-7-0x000000001C100000-0x000000001C5CE000-memory.dmp

Filesize
4.8MB

Download
memory/3232-6-0x000000001BBE0000-0x000000001BBEE000-memory.dmp

Filesize
56KB

Download
memory/3232-39-0x00007FFC45400000-0x00007FFC45DA1000-memory.dmp

Filesize
9.6MB

Download
memory/3232-3-0x000000001B9F0000-0x000000001BA4C000-memory.dmp

Filesize
368KB

Download
memory/3232-2-0x00007FFC45400000-0x00007FFC45DA1000-memory.dmp

Filesize
9.6MB

Download
memory/3232-38-0x00007FFC456B5000-0x00007FFC456B6000-memory.dmp

Filesize
4KB

Download
memory/3232-1-0x00007FFC45400000-0x00007FFC45DA1000-memory.dmp

Filesize
9.6MB

Download
memory/3232-0-0x00007FFC456B5000-0x00007FFC456B6000-memory.dmp

Filesize
4KB

Download
memory/3232-25-0x00000000013F0000-0x0000000001402000-memory.dmp

Filesize
72KB

Download
memory/3232-8-0x000000001C670000-0x000000001C70C000-memory.dmp

Filesize
624KB

Download
memory/3232-27-0x000000001B9D0000-0x000000001B9D8000-memory.dmp

Filesize
32KB

Download
memory/3232-28-0x000000001D0E0000-0x000000001D142000-memory.dmp

Filesize
392KB

Download
memory/3232-29-0x000000001DA50000-0x000000001E00A000-memory.dmp

Filesize
5.7MB

Download
memory/3232-30-0x000000001E010000-0x000000001E100000-memory.dmp

Filesize
960KB

Download
memory/3232-31-0x000000001D240000-0x000000001D25E000-memory.dmp

Filesize
120KB

Download
memory/3232-32-0x000000001E110000-0x000000001E159000-memory.dmp

Filesize
292KB

Download
memory/3232-33-0x00007FFC45400000-0x00007FFC45DA1000-memory.dmp

Filesize
9.6MB

Download
memory/3232-34-0x000000001E1F0000-0x000000001E260000-memory.dmp

Filesize
448KB

Download
memory/3232-35-0x00007FFC45400000-0x00007FFC45DA1000-memory.dmp

Filesize
9.6MB

Download
memory/3232-37-0x000000001CD30000-0x000000001CD38000-memory.dmp

Filesize
32KB

Download
memory/4012-21-0x00007FFC45400000-0x00007FFC45DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4012-16-0x00007FFC45400000-0x00007FFC45DA1000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads