Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-08-2024 17:44

General

  • Target

    1.exe

  • Size

    917KB

  • MD5

    52650eecab548e66af5a61020cc4559c

  • SHA1

    b6d081535cdc8cbbbfed1128b1bcf361065148b6

  • SHA256

    b161c18a7a4b8d72ef498608c9738e57acbe3ffa633154dbe3e3d7bd56e67408

  • SHA512

    25cbed29ff0d197e83177fb4ba68ed18e4248d49fa266d51959ff4facd342a4efd0854d90559543cb7902ca0cec7dfd298dbf6626846a01e6a3504dfa835900e

  • SSDEEP

    24576:8+5T4MROxnFi3frGrZlI0AilFEvxHiFekO:V50MiofSrZlI0AilFEvxHis

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4276
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7fmmfm5q.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BE3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9BE2.tmp"
        3⤵
          PID:2112

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\7fmmfm5q.dll

      Filesize

      76KB

      MD5

      2b0db1c8d9cfa3421e08be69070bfd29

      SHA1

      7be5d7beeab72c9a2e26474bc78b2cee332f7fd0

      SHA256

      40dc7228f66b129db11148ff25a30edb89750c67dbcc0283e502cd2916f244c4

      SHA512

      a02250d2d285b6803b2eeddab57875e79ffa328189f3ee17876e81cc4511b9e6032c56c8271b8f0cf52be6fadeb8ca9f195e4a1bd92b2957170daf77af6e602a

    • C:\Users\Admin\AppData\Local\Temp\RES9BE3.tmp

      Filesize

      1KB

      MD5

      d6103eda4fa8e8e7c85fd53d59df9175

      SHA1

      ecde491894d663b3a6e4dcfa59d5aaea74cedd42

      SHA256

      799231ba61c851af790ca1466174c269715ab80c04df98b4bc624198a5b33363

      SHA512

      4e3491b600e9a4db4ac31ab6e56bc6448e223800621e8dc0d8196c46013136a3f7f8078c49f937b2cd996f89e098e75f79c7507d0e3e0d482406ebc9d0fb93ff

    • \??\c:\Users\Admin\AppData\Local\Temp\7fmmfm5q.0.cs

      Filesize

      208KB

      MD5

      6a68b8f21d5bd6366bc1289691c2dbb9

      SHA1

      c2de5aa4ef7a7012e6299a6983bffcf55b245acb

      SHA256

      418723ac79f8c65184a71344edbd4fe384f7cc196abd7058339ac17de89f5de7

      SHA512

      0827e72464eced817313efdf11f1bc33574232afe33c16826db108de08f632dcbc43832df3587449405773df7256354f5a68063878f377fb7f61820e0cc30dcb

    • \??\c:\Users\Admin\AppData\Local\Temp\7fmmfm5q.cmdline

      Filesize

      349B

      MD5

      0bc7fab807af25ba3f45bd120c2af8a0

      SHA1

      b32014702ab65a0312213d05752814ba78f9dd85

      SHA256

      e99c033f47202eedd386f3591714f3e8bd2f09bd7d2dc2e0625cc9d5d4e5fa06

      SHA512

      9ad112070df8c80f5a276c172964174b38ba217f0fd397943f97a23386561848cae911d77a15ac9ec21084fb69e61e44e447429cf05c6565d2ad82dca143aada

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC9BE2.tmp

      Filesize

      676B

      MD5

      47a9eea0641253a39fdc57550c5b052b

      SHA1

      4dc0f661cf0b11ddb1ec5c3038b5048677c287e3

      SHA256

      e638948a6a6a470931649ab75454e592977d22ffedcf3efa2d548b19b2ca3c40

      SHA512

      e40719fa7bfe7e00fb6c899a1b69a33b5ad09a843a98a3ac361d8b4a6c80a846221028a36ea92c369f6e0da1f7cb107227bcb4c4e940ffc64561d6f3dd24f5a0

    • memory/4276-23-0x000000001C640000-0x000000001C656000-memory.dmp

      Filesize

      88KB

    • memory/4276-26-0x0000000000C30000-0x0000000000C38000-memory.dmp

      Filesize

      32KB

    • memory/4276-7-0x000000001BA10000-0x000000001BEDE000-memory.dmp

      Filesize

      4.8MB

    • memory/4276-6-0x00007FF962790000-0x00007FF963131000-memory.dmp

      Filesize

      9.6MB

    • memory/4276-39-0x00007FF962790000-0x00007FF963131000-memory.dmp

      Filesize

      9.6MB

    • memory/4276-5-0x000000001B530000-0x000000001B53E000-memory.dmp

      Filesize

      56KB

    • memory/4276-2-0x000000001B340000-0x000000001B39C000-memory.dmp

      Filesize

      368KB

    • memory/4276-38-0x00007FF962A45000-0x00007FF962A46000-memory.dmp

      Filesize

      4KB

    • memory/4276-1-0x00007FF962790000-0x00007FF963131000-memory.dmp

      Filesize

      9.6MB

    • memory/4276-0-0x00007FF962A45000-0x00007FF962A46000-memory.dmp

      Filesize

      4KB

    • memory/4276-25-0x0000000000B00000-0x0000000000B12000-memory.dmp

      Filesize

      72KB

    • memory/4276-8-0x000000001BF80000-0x000000001C01C000-memory.dmp

      Filesize

      624KB

    • memory/4276-27-0x0000000000DC0000-0x0000000000DC8000-memory.dmp

      Filesize

      32KB

    • memory/4276-28-0x000000001CA20000-0x000000001CA82000-memory.dmp

      Filesize

      392KB

    • memory/4276-29-0x000000001D390000-0x000000001D94A000-memory.dmp

      Filesize

      5.7MB

    • memory/4276-30-0x000000001D950000-0x000000001DA40000-memory.dmp

      Filesize

      960KB

    • memory/4276-31-0x000000001CB80000-0x000000001CB9E000-memory.dmp

      Filesize

      120KB

    • memory/4276-32-0x000000001DA50000-0x000000001DA99000-memory.dmp

      Filesize

      292KB

    • memory/4276-33-0x00007FF962790000-0x00007FF963131000-memory.dmp

      Filesize

      9.6MB

    • memory/4276-34-0x000000001DB30000-0x000000001DBA0000-memory.dmp

      Filesize

      448KB

    • memory/4276-35-0x00007FF962790000-0x00007FF963131000-memory.dmp

      Filesize

      9.6MB

    • memory/4276-37-0x000000001C670000-0x000000001C678000-memory.dmp

      Filesize

      32KB

    • memory/4540-21-0x00007FF962790000-0x00007FF963131000-memory.dmp

      Filesize

      9.6MB

    • memory/4540-14-0x00007FF962790000-0x00007FF963131000-memory.dmp

      Filesize

      9.6MB