Analysis

  • max time kernel
    140s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 16:11

General

  • Target

    Stardock Products Patch v1.5.exe

  • Size

    39.5MB

  • MD5

    c946cd0a675d6667140cefbd71e3e808

  • SHA1

    d2b8ef30c2cdee1a552f8f087f27c9b8ff501136

  • SHA256

    b20afa845e2aeabb94c131567c1b0576581b27b6336826007ee38f2619f3b3f8

  • SHA512

    bc361fab7455f2fc6f6084a5f67ce8afbbb48c4ff46a54d004e937fc318abd372a4be02677916e5de6700714eb608a3a29c4841084ffe0062c1b9fda3611ed5b

  • SSDEEP

    786432:wwcWkXE5sDo0HldnYLeDdR2B6YL8qNGO0cePX0lrnql+ZYhZ:wwKE58HYLAdR2rL87O0ce+qloYh

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Stardock Products Patch v1.5.exe
    "C:\Users\Admin\AppData\Local\Temp\Stardock Products Patch v1.5.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Stardock Products Patch.X86.1.0.0.0\Native.dll

    Filesize

    74KB

    MD5

    13e8f594cb3731201d2b74d9eaca249a

    SHA1

    f292602da21af27aad668d0b8c982aff31cd322c

    SHA256

    fe21d378f1f0138dac03ec59b8e635229078132977d43fe832e0a0cdb9d27fcb

    SHA512

    808795858ddc2905884f3f1087220c315a8f4e2c9ab7e2440edae9c817dcd3bda2637719d8efc73c490b098117b08a398784210059f82341289e74c1a62624e7

  • \Windows\SysWOW64\bassmod.dll

    Filesize

    33KB

    MD5

    e4ec57e8508c5c4040383ebe6d367928

    SHA1

    b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

    SHA256

    8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

    SHA512

    77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

  • memory/2684-21-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-33-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-8-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-2-0x0000000074190000-0x000000007487E000-memory.dmp

    Filesize

    6.9MB

  • memory/2684-4-0x00000000049B0000-0x00000000049C0000-memory.dmp

    Filesize

    64KB

  • memory/2684-9-0x0000000074190000-0x000000007487E000-memory.dmp

    Filesize

    6.9MB

  • memory/2684-1-0x0000000000B10000-0x0000000003292000-memory.dmp

    Filesize

    39.5MB

  • memory/2684-18-0x000000007419E000-0x000000007419F000-memory.dmp

    Filesize

    4KB

  • memory/2684-19-0x0000000074190000-0x000000007487E000-memory.dmp

    Filesize

    6.9MB

  • memory/2684-20-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-0-0x000000007419E000-0x000000007419F000-memory.dmp

    Filesize

    4KB

  • memory/2684-22-0x0000000074190000-0x000000007487E000-memory.dmp

    Filesize

    6.9MB

  • memory/2684-3-0x000000001DCA0000-0x00000000222C2000-memory.dmp

    Filesize

    70.1MB

  • memory/2684-25-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-23-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-26-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-28-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-29-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-30-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-31-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-32-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-24-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-34-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-35-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB

  • memory/2684-36-0x0000000004A00000-0x0000000004A13000-memory.dmp

    Filesize

    76KB