Analysis
-
max time kernel
24s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 03:41
Static task
static1
Behavioral task
behavioral1
Sample
d4983a06051b0774eb951e1e9a51e1b5.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d4983a06051b0774eb951e1e9a51e1b5.exe
Resource
win10v2004-20240226-en
General
-
Target
d4983a06051b0774eb951e1e9a51e1b5.exe
-
Size
13.9MB
-
MD5
d4983a06051b0774eb951e1e9a51e1b5
-
SHA1
9d748d068442f2b5aae091cd7c0dd8eeaa68de21
-
SHA256
4a8a70d55a86a4950958f4449542f81ef2ce761bbc3dd86d012c4baf922f5538
-
SHA512
27afa431e0d45c318e0c27ded798ac02709dbf386a1c2d85c1c67be19340bab8c46d8123f9763657a85d22091bd9629939a28254c618dc9e8a721a5dc942699b
-
SSDEEP
393216:3BmT6Bp1pMTwbWR2HPNQymjOZ7hzrSmza:IS+eWR2HFQymjOZ5vm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ISBEW64.exepid process 4284 ISBEW64.exe -
Loads dropped DLL 8 IoCs
Processes:
d4983a06051b0774eb951e1e9a51e1b5.exepid process 2604 d4983a06051b0774eb951e1e9a51e1b5.exe 2604 d4983a06051b0774eb951e1e9a51e1b5.exe 2604 d4983a06051b0774eb951e1e9a51e1b5.exe 2604 d4983a06051b0774eb951e1e9a51e1b5.exe 2604 d4983a06051b0774eb951e1e9a51e1b5.exe 2604 d4983a06051b0774eb951e1e9a51e1b5.exe 2604 d4983a06051b0774eb951e1e9a51e1b5.exe 2604 d4983a06051b0774eb951e1e9a51e1b5.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
d4983a06051b0774eb951e1e9a51e1b5.exedescription pid process target process PID 2604 wrote to memory of 4284 2604 d4983a06051b0774eb951e1e9a51e1b5.exe ISBEW64.exe PID 2604 wrote to memory of 4284 2604 d4983a06051b0774eb951e1e9a51e1b5.exe ISBEW64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4983a06051b0774eb951e1e9a51e1b5.exe"C:\Users\Admin\AppData\Local\Temp\d4983a06051b0774eb951e1e9a51e1b5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{3816300A-A779-44D9-95CC-F22E964A987F}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{3816300A-A779-44D9-95CC-F22E964A987F}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{494F6931-0296-44AB-B754-83D447B4D86D}2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\{3816300A-A779-44D9-95CC-F22E964A987F}\ISBEW64.exeFilesize
114KB
MD52a276ba2b7782476302c59d0f760f4bc
SHA143bbb884a7b65534c417ae5a3f3f17f7e80e2f7d
SHA256d3294cc8c750c4bd63016e87e9d2c53a501c173567f4edb9a3c6f1bd9836064a
SHA5126bed8d3291ed422aed187637838bfb957ea59c772be3bc52c12242474712f411e174afe55ed6955b910a8ce3635f1552260063cf6db428a4e34bc76a4e3e01f6
-
C:\Users\Admin\AppData\Local\Temp\{3816300A-A779-44D9-95CC-F22E964A987F}\{12F382E1-63D4-4B94-BD32-5F845E74FC79}\DIFxData.iniFilesize
86B
MD510baa5b67536f4433f37534b9c8bb828
SHA182e5c34b1279afda223b639b49078d03c52875f5
SHA2561b9fd5c1f18357bd459be20bfcbf47ee18fa0c5d5cc42f6aed2705d5868b65f4
SHA51249c6798ebb3b6137cafb78b88350d02094367523dcf8f9e580de1941e514b8b3df786d1d817090e5dab80ac4d0d015796b2ce28b296db31d111e0d0bbaeebb37
-
C:\Users\Admin\AppData\Local\Temp\{3816300A-A779-44D9-95CC-F22E964A987F}\{12F382E1-63D4-4B94-BD32-5F845E74FC79}\FontData.iniFilesize
39B
MD500f313e3e007599349a0c4d81c7807c4
SHA1f0171f15aab836a1979d3833e46b5e59e4ea32e0
SHA256766ee687d90b0217eb41cb85aca04375bdc24db986a33536631f864b7ce1a08a
SHA5128bb25a62c0b1640dec36403a493ed54c05f7cde7b7357c8faea785a79c4b76bbe6a3d6fe78db52b558a37abac90c2b2e8b13868a76294554d51670e9fa8764ad
-
C:\Users\Admin\AppData\Local\Temp\{3816300A-A779-44D9-95CC-F22E964A987F}\{12F382E1-63D4-4B94-BD32-5F845E74FC79}\VASData.iniFilesize
30B
MD5b16ff78e4420d4049da82fffe3026d31
SHA1612be1fde59d3d4534a4d8e0947b65060ed6146b
SHA256029f695d7a558a0070bdb42c07d35c7ae436fbd0688079b7ada58093505d9579
SHA5128042f5a1f12ef644b7def42c52c90a252ff4a6c099956530cff8147daf2edd8934f5bc79bb560f550d47755fead71a1d0fbe7d52fdc0fb30a0ad64471beaaf7a
-
C:\Users\Admin\AppData\Local\Temp\{3816300A-A779-44D9-95CC-F22E964A987F}\{12F382E1-63D4-4B94-BD32-5F845E74FC79}\_IsRes.dllFilesize
545KB
MD5936570437cdd944172b100e677603523
SHA197e56b29733846d4ffef7791830f3e9ae355783a
SHA256682e00f308be80c69172b0e7d76f2ed555b7838be7b7f61774687aa1cdf1ce8b
SHA512d357c39570079e2ce64c0affb0c33b46033c41244df9812e69b7bff7cc75287ea103bbe27dc7ae775b41d4a2dc0fe1088ad04369b6b435dbdb5ef70145ab9df4
-
C:\Users\Admin\AppData\Local\Temp\{3816300A-A779-44D9-95CC-F22E964A987F}\{12F382E1-63D4-4B94-BD32-5F845E74FC79}\isrt.dllFilesize
217KB
MD50f68d760fb480a1b039ca7d6b877d24c
SHA1259d101a49646c3abe17114111ff9aa7df1b8fc2
SHA2565974ce20a780d384383cfc24af4dc62bc22ca67ce1d76ea9981c42631480ab63
SHA512d551553ceca5b9ba86f7422893df78ce71167096cbeae65319c344abf57601e8e6c8f9779a9a45ed28ce32c3e1c477b843d8ad4437e0643c0fabf56ab7f586d1
-
C:\Users\Admin\AppData\Local\Temp\{3816300A-A779-44D9-95CC-F22E964A987F}\{12F382E1-63D4-4B94-BD32-5F845E74FC79}\setup.inxFilesize
227KB
MD54d8854a0a5be89a89c9fa572950c0f35
SHA15f4a5195a7e83cb60f441a3f2522fe2b4f3efc54
SHA25630379f60779330bfe466c705c6b9cd964f8502f43c4534ba8b10812e1406dffd
SHA5124f68bfc8f169696564187958b9a2f4a30229aadb94e9d2a0b27e4ca3ec08c7d2b7efac505e3d74a14579a67764893a7e069b6e12af2777490fcc07131ae0277f
-
C:\Users\Admin\AppData\Local\Temp\{8BE9D96D-5216-4EB5-9C42-0929C0BBA3CF}\Disk1\ISSetup.dllFilesize
542KB
MD52dd1c4a68e2a8a401018f5efdab5adde
SHA113fc964947516230c70d38281d0312bc1afe13c0
SHA2567c173cdaea8e3a3cc95b7196681cb904f3996f81289d5890b30f38c99eba45ae
SHA512c69f3e46d36e07e6093f66cf072c83fc8c7249ff86c9cd84168ee46dbb7a621d562cee7de5685b408bd5f71889d6433e99ff8045955e5b8ab2c9eeb71941d165
-
C:\Users\Admin\AppData\Local\Temp\{8BE9D96D-5216-4EB5-9C42-0929C0BBA3CF}\_Setup.dllFilesize
153KB
MD57d0a617a8820e4615d3af7012938214c
SHA1625dc413c271403512e77cbc15eac534a78b5522
SHA256f8ccb1f1bf5c6d066056c67644b43b561f994a909f2d0d4c53071016f2dccd1e
SHA51267c3e2c71c07022575e92ad0038e95dd1899311f680fe7dd7296a2dddb2e4235a8b5962e4b00679992917e3a93fa719337f8f5ec317d1fe493d992e4f27b2869
-
C:\Users\Admin\AppData\Local\Temp\{8BE9D96D-5216-4EB5-9C42-0929C0BBA3CF}\setup.iniFilesize
521B
MD512356dea017849ba88c3eb730f95c367
SHA1afdc737adcab61d274b6f9e5da1ad8ffdc997c23
SHA25658d82695088e2f94e6186034364fd8469fc9a01eb6e6a63d32d6e2e3dd457662
SHA5121d8e4fad830be971f2a8c47fd083b172fea30233c6f2c706ce34297bc9cefbf3d512151c7a16a7cdde269fb3fdc527dccc8ba6b457488672f9d3844b3cef5ad4
-
memory/2604-101-0x0000000005240000-0x00000000052C9000-memory.dmpFilesize
548KB
-
memory/2604-96-0x0000000002B40000-0x0000000002B42000-memory.dmpFilesize
8KB
-
memory/2604-94-0x0000000004F80000-0x0000000005008000-memory.dmpFilesize
544KB
-
memory/2604-30-0x00000000027F0000-0x000000000298A000-memory.dmpFilesize
1.6MB
-
memory/2604-26-0x00000000004C0000-0x00000000004C2000-memory.dmpFilesize
8KB
-
memory/2604-24-0x00000000027F0000-0x000000000298A000-memory.dmpFilesize
1.6MB
-
memory/2604-128-0x00000000027F0000-0x000000000298A000-memory.dmpFilesize
1.6MB
-
memory/2604-129-0x0000000004F80000-0x0000000005008000-memory.dmpFilesize
544KB
-
memory/2604-130-0x00000000004C0000-0x00000000004C2000-memory.dmpFilesize
8KB