Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2025, 19:34

General

  • Target

    $TEMP/Toolbar.exe

  • Size

    198KB

  • MD5

    5a82a45f2e0aaf617c8d511d43100fe1

  • SHA1

    515aa5b88b8c129046706d8542bee3699f62968c

  • SHA256

    4761b338dc54c9a3adec6a79024029d5041b75f4f9bb30baf98b5d3ff34d7614

  • SHA512

    4811406accf89eac961a349b78449185e894ae4c89a7c380da1e67005c953ef782e57d2370fdc09027bb36586ad57d2476888b33b5913ca74142c72b1c17051a

  • SSDEEP

    6144:f4KTJDvFeKBw8v92A7BBNC0kz/ifYxUxBE1T:z1Bv/NwbWTC

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\GLBD910.tmp
      C:\Users\Admin\AppData\Local\Temp\GLBD910.tmp 4736 C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2460

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\GLBD910.tmp

          Filesize

          70KB

          MD5

          793a2c91c1b687b58809d7bb079457a7

          SHA1

          29363e8d0591accb9dc84512c6e634e1e17c591e

          SHA256

          fcb29c8c20a765616126e5a14beb2761ece72c26bd459b9816e65e81770fd3b4

          SHA512

          a50e03b15e0a735d41fe3a5213c454cbb76d934ae27e367f8b0f8a38c1666926bdd161b2a88e7cc7811a9f39635c16d6e2b62c07dd1aee6880639903ecbaa31b

        • \Users\Admin\AppData\Local\Temp\GLCD93F.tmp

          Filesize

          161KB

          MD5

          8c97d8bb1470c6498e47b12c5a03ce39

          SHA1

          15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7

          SHA256

          a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a

          SHA512

          7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

        • \Users\Admin\AppData\Local\Temp\GLMD950.tmp

          Filesize

          12KB

          MD5

          484cb68472473a1a84ff07996bb8c1f6

          SHA1

          bce9d810f2558e73854e7c8e05f122b002558e9a

          SHA256

          15bb390af019d92e1d02771b02335fa360db1bb34bcf4f0c72705027428f4ff1

          SHA512

          5f756d11290e0240fabeab6cb638f7e42024b95b5a44eea6b44dba610919a9d9d5654a87af29ef249fb22bfb9eae7dadd3abb42faa594a465efa1ff358a2fd47