Overview

overview

8

Static

static

Antl-Setup...1).exe

windows7-x64

8

Antl-Setup...1).exe

windows10-2004-x64

7

Analysis

  • max time kernel
    204s
  • max time network
    224s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 09:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Antl-Setup-v2.05.83_x64(1).exe

  • Size

    97.2MB

  • MD5

    d1d5bddab1d1985e1dee0696b7c9c1fa

  • SHA1

    fb73395cfd6f7f37df8bb20020d0c5bf6fe9daad

  • SHA256

    f920ffbbd07b725e4318bc71366b30f2ad01b40cd6250294f54badf28e93cefd

  • SHA512

    1e823e00e3e5d58712d6c52c44427bcd6ff9337dfcdc92d6de6c8463aa450b2886cba0f71258598a4c0246254de02b4aadeb15a8c9c5275b91195401340160db

  • SSDEEP

    3145728:v2LPmPwJOHt9eFpc13E1oD8mF5TvYrdknEP5g16:uziwc8pc13OMs5Q6

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Antl-Setup-v2.05.83_x64(1).exe
    "C:\Users\Admin\AppData\Local\Temp\Antl-Setup-v2.05.83_x64(1).exe"
    1⤵
    • Loads dropped DLL
    PID:3268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nso8379.tmp\System.dll
    Filesize

    29KB

    MD5

    26c8a92678f1b970ac2a700bb844c309

    SHA1

    c821a5980c31b0b35f1505cde836d6769f45e3a3

    SHA256

    2a7b5d1cab96a5280b0694d0ed54510129626a1ba36a51bd34d546972b7d18b8

    SHA512

    fba6e371853fd6c27097eb7cce7ffc59d71e4f0a9b5e55de06472d094b70c44a409bd82f39d9a27a814e826ab8468c59e947401a3c3ead1f057cbac236588860

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nso8379.tmp\nsDialogs.dll
    Filesize

    14KB

    MD5

    8f45e78d9d02ca8a9f9c274a8bfe2a57

    SHA1

    9b3838e1d2d4fbc1c84e1252747e96aa1b223d83

    SHA256

    78f9594721361fd3415b8c5194f9c9b87c580d6a70ddb95f2c4743c61ce68ebe

    SHA512

    125f1bcf833e0c233ebee552c164d9726769f06e5163467888abea08048fdae60a94b903ef97ba82ca9cf684f3c027d9605d54e9efe794df3e452f9b20e4ca96

    Download Submit