0fcb4a667b99ae0dc2549e5458fda7341a93b336a62f64dea224a1f16b3935af

General

Target

Inwigilator 360 demo/InstalujDemo.exe
Size

3.0MB
MD5

e42a11c5397cb89381f62427aebc7dd3
SHA1

62bb6cea55d10ff3ef7c0d85ef01d3951731a569
SHA256

c212faf6938b25555d39ea79b0ef13a7407b60d1879316a005d2c7a2bc5a104d
SHA512

569a1dcb4dbc4d0e8a7e049fba8c622647fdee65113955e856a4585fa61415d0d8f2b044129f89695df371c1e7e6f5d3326b292312b95a470e7d4917acfbb397

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

is-86OQ4.tmp

pid process

1948 is-86OQ4.tmp
Loads dropped DLL 3 IoCs

Processes:

InstalujDemo.exeis-86OQ4.tmp

pid process

2016 InstalujDemo.exe
1948 is-86OQ4.tmp
1948 is-86OQ4.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1948	is-86OQ4.tmp

pid	process
2016	InstalujDemo.exe
1948	is-86OQ4.tmp
1948	is-86OQ4.tmp

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

InstalujDemo.exe

description	pid	process	target process
PID 2016 wrote to memory of 1948	2016	InstalujDemo.exe	is-86OQ4.tmp
PID 2016 wrote to memory of 1948	2016	InstalujDemo.exe	is-86OQ4.tmp
PID 2016 wrote to memory of 1948	2016	InstalujDemo.exe	is-86OQ4.tmp
PID 2016 wrote to memory of 1948	2016	InstalujDemo.exe	is-86OQ4.tmp
PID 2016 wrote to memory of 1948	2016	InstalujDemo.exe	is-86OQ4.tmp
PID 2016 wrote to memory of 1948	2016	InstalujDemo.exe	is-86OQ4.tmp
PID 2016 wrote to memory of 1948	2016	InstalujDemo.exe	is-86OQ4.tmp

C:\Users\Admin\AppData\Local\Temp\Inwigilator 360 demo\InstalujDemo.exe
"C:\Users\Admin\AppData\Local\Temp\Inwigilator 360 demo\InstalujDemo.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\is-79GHP.tmp\is-86OQ4.tmp
C:\Users\Admin\AppData\Local\Temp\is-79GHP.tmp\is-86OQ4.tmp /SL4 $70122 "C:\Users\Admin\AppData\Local\Temp\Inwigilator 360 demo\InstalujDemo.exe" 3091997 68096
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-79GHP.tmp\is-86OQ4.tmp
Filesize
551KB

MD5
2a3152c6ff21197f67ca1d9360ced0dc

SHA1
5272f3d3d324b23de1b53c84ef598de494ad7821

SHA256
96b8be7cb1fec885cba93386b5b6814452efc8d0ef391385adafb34a611ab5ac

SHA512
19ba6d65a3c256c80cab767210c837197046250d769fa915b5023bf99bf53d21c56892da15ebc82891ba5fd9a45e0336fefc94ebabe5698e7911c6fabbb09cd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-79GHP.tmp\is-86OQ4.tmp
Filesize
551KB

MD5
2a3152c6ff21197f67ca1d9360ced0dc

SHA1
5272f3d3d324b23de1b53c84ef598de494ad7821

SHA256
96b8be7cb1fec885cba93386b5b6814452efc8d0ef391385adafb34a611ab5ac

SHA512
19ba6d65a3c256c80cab767210c837197046250d769fa915b5023bf99bf53d21c56892da15ebc82891ba5fd9a45e0336fefc94ebabe5698e7911c6fabbb09cd0

Download Submit
\Users\Admin\AppData\Local\Temp\is-79GHP.tmp\is-86OQ4.tmp
Filesize
551KB

MD5
2a3152c6ff21197f67ca1d9360ced0dc

SHA1
5272f3d3d324b23de1b53c84ef598de494ad7821

SHA256
96b8be7cb1fec885cba93386b5b6814452efc8d0ef391385adafb34a611ab5ac

SHA512
19ba6d65a3c256c80cab767210c837197046250d769fa915b5023bf99bf53d21c56892da15ebc82891ba5fd9a45e0336fefc94ebabe5698e7911c6fabbb09cd0

Download Submit
\Users\Admin\AppData\Local\Temp\is-K0CT0.tmp\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-K0CT0.tmp\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1948-58-0x0000000000000000-mapping.dmp

Download
memory/2016-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/2016-55-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2016-56-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing