Overview
overview
10Static
static
setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
10setup_x86_...4).exe
windows7_x64
setup_x86_...4).exe
windows10_x64
10setup_x86_...5).exe
windows7_x64
setup_x86_...5).exe
windows10_x64
10setup_x86_...6).exe
windows7_x64
setup_x86_...6).exe
windows10_x64
10setup_x86_...7).exe
windows7_x64
10setup_x86_...7).exe
windows10_x64
setup_x86_...8).exe
windows7_x64
8setup_x86_...8).exe
windows10_x64
10setup_x86_...9).exe
windows7_x64
setup_x86_...9).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
10setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
10setup_x86_...2).exe
windows10_x64
10setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
10Resubmissions
11-07-2024 05:43
240711-gej4lstgrf 1006-09-2021 14:13
210906-rjpvrsedbm 1008-07-2021 11:08
210708-4gztl3mwl6 1008-07-2021 08:02
210708-klfb4qeda6 1007-07-2021 09:39
210707-nem57xyvf2 1006-07-2021 17:51
210706-7pcrmjy3fa 1006-07-2021 13:45
210706-eybelwcq86 10Analysis
-
max time kernel
1436s -
max time network
1486s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
08-07-2021 08:02
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install - копия (10).exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
setup_x86_x64_install - копия (10).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
setup_x86_x64_install - копия (11).exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install - копия (11).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
setup_x86_x64_install - копия (12).exe
Resource
win7v20210408
Behavioral task
behavioral6
Sample
setup_x86_x64_install - копия (12).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
setup_x86_x64_install - копия (13).exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
setup_x86_x64_install - копия (13).exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
setup_x86_x64_install - копия (14).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
setup_x86_x64_install - копия (14).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
setup_x86_x64_install - копия (15).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
setup_x86_x64_install - копия (15).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
setup_x86_x64_install - копия (16).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
setup_x86_x64_install - копия (16).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
setup_x86_x64_install - копия (17).exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
setup_x86_x64_install - копия (17).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
setup_x86_x64_install - копия (18).exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
setup_x86_x64_install - копия (18).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
setup_x86_x64_install - копия (19).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
setup_x86_x64_install - копия (19).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
setup_x86_x64_install - копия (2).exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
setup_x86_x64_install - копия (2).exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
setup_x86_x64_install - копия (20).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
setup_x86_x64_install - копия (20).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
setup_x86_x64_install - копия (21).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
setup_x86_x64_install - копия (21).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
setup_x86_x64_install - копия (22).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
setup_x86_x64_install - копия (22).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
setup_x86_x64_install - копия (23).exe
Resource
win7v20210408
Behavioral task
behavioral30
Sample
setup_x86_x64_install - копия (23).exe
Resource
win10v20210410
General
-
Target
setup_x86_x64_install - копия (18).exe
-
Size
3.2MB
-
MD5
3ae1c212119919e5fce71247286f8e0e
-
SHA1
97c1890ab73c539056f95eafede319df774e9d38
-
SHA256
30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e
-
SHA512
5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558
Malware Config
Signatures
-
resource yara_rule behavioral17/files/0x00030000000130db-69.dat aspack_v212_v242 behavioral17/files/0x00030000000130db-70.dat aspack_v212_v242 behavioral17/files/0x00030000000130db-73.dat aspack_v212_v242 behavioral17/files/0x00030000000130db-71.dat aspack_v212_v242 behavioral17/files/0x00030000000130d6-77.dat aspack_v212_v242 behavioral17/files/0x00030000000130d9-83.dat aspack_v212_v242 behavioral17/files/0x00030000000130d9-82.dat aspack_v212_v242 behavioral17/files/0x00030000000130d6-76.dat aspack_v212_v242 behavioral17/files/0x00030000000130d7-75.dat aspack_v212_v242 behavioral17/files/0x00030000000130d7-74.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 1968 setup_installer.exe 2020 setup_install.exe -
Loads dropped DLL 12 IoCs
pid Process 1248 setup_x86_x64_install - копия (18).exe 1968 setup_installer.exe 1968 setup_installer.exe 1968 setup_installer.exe 1968 setup_installer.exe 1968 setup_installer.exe 1968 setup_installer.exe 2020 setup_install.exe 2020 setup_install.exe 2020 setup_install.exe 2020 setup_install.exe 2020 setup_install.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1248 wrote to memory of 1968 1248 setup_x86_x64_install - копия (18).exe 26 PID 1248 wrote to memory of 1968 1248 setup_x86_x64_install - копия (18).exe 26 PID 1248 wrote to memory of 1968 1248 setup_x86_x64_install - копия (18).exe 26 PID 1248 wrote to memory of 1968 1248 setup_x86_x64_install - копия (18).exe 26 PID 1248 wrote to memory of 1968 1248 setup_x86_x64_install - копия (18).exe 26 PID 1248 wrote to memory of 1968 1248 setup_x86_x64_install - копия (18).exe 26 PID 1248 wrote to memory of 1968 1248 setup_x86_x64_install - копия (18).exe 26 PID 1968 wrote to memory of 2020 1968 setup_installer.exe 27 PID 1968 wrote to memory of 2020 1968 setup_installer.exe 27 PID 1968 wrote to memory of 2020 1968 setup_installer.exe 27 PID 1968 wrote to memory of 2020 1968 setup_installer.exe 27 PID 1968 wrote to memory of 2020 1968 setup_installer.exe 27 PID 1968 wrote to memory of 2020 1968 setup_installer.exe 27 PID 1968 wrote to memory of 2020 1968 setup_installer.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (18).exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (18).exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\7zS0B7D7205\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0B7D7205\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020
-
-