Overview

overview

8

Static

static

setup_pstm...ta.exe

windows7-x64

8

setup_pstm...ta.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    82s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2023 10:44

Sharing

Copy URL
Twitter E-mail

General

  • Target

    setup_pstmafm44x_20220402_Beta.exe

  • Size

    28MB

  • MD5

    153d9212e049fa053d2337de207f169f

  • SHA1

    8c8b0692d48c3bc8ede9f426993f283943c79537

  • SHA256

    2e5f727b95527d3320a50400c48bec4208dd10f39776e667fccfc943287f27ff

  • SHA512

    daa6a6e39824ded9cbc716ac2aa734c7be124fbfb1156ed03818b9d7891d7cbf7685c73f82cdf82f0812ae9f64d0f1da89523dc5060f589da04b06ef8230d6a0

  • SSDEEP

    786432:iliap7IQWxhhh+3vLccvBG7yadtUlkiYno6RgzQCTyr0satP8:iliaBEhhh+3vNvBGyeGk5o6i0Ayr0sY0

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_pstmafm44x_20220402_Beta.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_pstmafm44x_20220402_Beta.exe"
    Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Users\Admin\AppData\Local\Temp\is-OK95E.tmp\setup_pstmafm44x_20220402_Beta.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-OK95E.tmp\setup_pstmafm44x_20220402_Beta.tmp" /SL5="$B005E,29710762,721408,C:\Users\Admin\AppData\Local\Temp\setup_pstmafm44x_20220402_Beta.exe"
      Executes dropped EXE
      PID:4128

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\is-OK95E.tmp\setup_pstmafm44x_20220402_Beta.tmp
                            MD5

                            8e2d270339dcd0a68fbb2f02a65d45dd

                            SHA1

                            bfcdb1f71692020858f96960e432e94a4e70c4a4

                            SHA256

                            506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811

                            SHA512

                            31eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647

                            Download Submit
                          • memory/4128-134-0x0000000000000000-mapping.dmp
                            Download
                          • memory/4188-132-0x0000000000400000-0x00000000004BE000-memory.dmp
                            Download
                          • memory/4188-136-0x0000000000400000-0x00000000004BE000-memory.dmp
                            Download
                          • memory/4188-137-0x0000000000400000-0x00000000004BE000-memory.dmp
                            Download