Overview

overview

10

Static

static

Setup.exe

windows7_x64

8

Setup.exe

windows7_x64

8

Setup.exe

windows7_x64

8

Setup.exe

windows11_x64

8

Setup.exe

windows10_x64

8

Setup.exe

windows10_x64

8

Setup.exe

windows10_x64

10

Resubmissions

12-09-2021 07:23

210912-h76zhscbc3 10

12-09-2021 07:04

210912-hwe2nafbaq 10

Analysis

  • max time kernel
    512s
  • max time network
    515s
  • platform
    windows7_x64
  • resource
    win7-jp
  • submitted
    12-09-2021 07:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup.exe

  • Size

    10.1MB

  • MD5

    32d11c996b67786686172b4179c6ee46

  • SHA1

    d99662924b9d260872bba995b233332ee0eab748

  • SHA256

    1d364c185082bf798f4ff21f33b63c84cc1407ca33be17793990190b59d2042c

  • SHA512

    5dd02bf6a325befea5ce450b453376bee609b03df562fafdf6603b9e6c84e534e5d13b42aaacf0a99f0ffdc767d529c63fd073c6cf76e193f6268fb54ce8276b

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
      "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
    MD5

    85ffda25e7f8584420496a45ff114eb5

    SHA1

    1ce8d2d592d1ca1509fb18a3d6cc8a251dc5c5f8

    SHA256

    124701995b3aefba458dc4f654ff2e6c8df014e9ab210525edc031abf24c0491

    SHA512

    5c07a29fc42e81a4591e8dbbea2a641b42a110bb31f4b6458794124246210af805bacd6949b95310038c5f19be392d33be081f2dce3946917e8972e00cc3fa90

    Download Submit
  • \Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
    MD5

    85ffda25e7f8584420496a45ff114eb5

    SHA1

    1ce8d2d592d1ca1509fb18a3d6cc8a251dc5c5f8

    SHA256

    124701995b3aefba458dc4f654ff2e6c8df014e9ab210525edc031abf24c0491

    SHA512

    5c07a29fc42e81a4591e8dbbea2a641b42a110bb31f4b6458794124246210af805bacd6949b95310038c5f19be392d33be081f2dce3946917e8972e00cc3fa90

    Download Submit
  • memory/1444-55-0x0000000000000000-mapping.dmp
    Download
  • memory/1660-53-0x0000000075561000-0x0000000075563000-memory.dmp
    Filesize

    8KB

    Download