Resubmissions
13-03-2023 06:29
230313-g841waah6v 1013-03-2023 05:52
230313-gk2wlsgg73 1013-03-2023 05:45
230313-gfsr5sgg57 7Analysis
-
max time kernel
195s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-es -
resource tags
-
submitted
13-03-2023 05:52
General
-
Target
Setup.exe
-
Size
120.1MB
-
MD5
5fb9b3c109ad471d0bc148329344e8ca
-
SHA1
21f2a06e7f83cb2886c16cafc20968f370fa2643
-
SHA256
c9ae7f8a79a27955d93c32f1b9fc3100496f4cdb6acfa848e80acabca6d1749f
-
SHA512
b50c9420e0709391be280b4f65be35bde9018388872c4ad675f104fd0093be22159a74b0d46b0d1c92043887824cb97464db452d422bcd339a1f3578b3f7456c
-
SSDEEP
1572864:uiM7DhczCaxWLABs8spKCFLme+A2akcvAYBkbKiD5DEeM9VCwQdUzk+:ulOCaELAO8WLiA2aTVkbKidc9IdUz/
Malware Config
Signatures
-
SnakeBOT
SnakeBOT is a heavily obfuscated .NET downloader.
-
Contains SnakeBOT related strings 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 20 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-D4BRT.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-D4BRT.tmp\Setup.tmp" /SL5="$70132,124988605,836608,C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files (x86)\Undertale\UNDERTALE_original.exe"C:\Program Files (x86)\Undertale\UNDERTALE_original.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 4402⤵
- Loads dropped DLL
- Program crash
-
-
C:\Program Files (x86)\Undertale\UNDERTALE_original.exe"C:\Program Files (x86)\Undertale\UNDERTALE_original.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 4402⤵
- Loads dropped DLL
- Program crash
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
1.9MB
MD586e39e9161c3d930d93822f1563c280d
SHA1f5944df4142983714a6d9955e6e393d9876c1e11
SHA2560b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
SHA5120a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
-
Filesize
55.2MB
MD5a7728805e9789cb1288e6d807aa46833
SHA19c07858aa3ea04319644cc246d04ffa2dd77323c
SHA25636e4544d49fbba8f484cd1c629085d240139b54e07dab6a466f0dd36f1753e98
SHA512f8f54db54d921eff62327733d8a4811dc1c0e5c0fd3b9c898a84cdfeba513ec8e9dde2a333ef411b0190106c80e0a2a1776dc927d3ad9e62d0b515999690237d
-
Filesize
3.7MB
MD562adbbb61850a3883c15a29a0d08df86
SHA1835a9f036668f592d49d790eb933d706097ddf01
SHA25671663af422d47908711fca5d24b4244b9eef78e1f2a45214ee59b14712de5500
SHA512a95b0afe81fd4535959da755f468672c8abd2215522ac324a156f47b3eed485b4589724ed9f51b3d78939afedf94d4afb9463ab256b54b2b5d65c7acc67359d3
-
Filesize
97B
MD5396f73a1185a5642f5f1e2538b64396a
SHA1d72d687a5a1258986f218bfccacc6118c39ec4f9
SHA256e267293f58d257d2dd1e00ad25425bdb798fcbf75256a7d45b7d7086159dbc58
SHA512e17cfca14ce79c71eea01973385fa4151989d40bfc5a04b97fd3534ff5b4f04b385d11867d80a60325aa0bd13403910fee73ab9379f0e05c669d24d5d95957da
-
Filesize
251KB
MD523767288e6a003aaaa54355cbe108da8
SHA1c7f21dc71491fe661c698f5c561405c0e3f423c1
SHA256209135c082a8ef8323479384e97d769d9b2d98f727bbb34a7806ce150b750c89
SHA512a870b2f99da48ad07f9b36d6730d74af5f285af12e21a24d61e6e3023d5917920bd343fe295b7374a2065bf9c09b6f1cbb03fbcf05206f4bd0544b5f0eb0e147
-
Filesize
2KB
MD5f98efa05e4c224bec6df0f38c1f41801
SHA1b73f247e46657c5e78c410d7d5bef50dac8c172e
SHA256303cfb51ad5a389296c7c86e4aea6d450276078d40d848df4a334e70d5b77885
SHA51213bad72f40efb3ca91bc28490974af4a7a40c6da5b11ae2f277cc24def56c32b2f9381b09c11a028e5bd27966f88085eb98aebb6f81e7893efdd76bc3981cf4a
-
Filesize
2.5MB
MD5d9bc11c23aa360311d6b237b23b0c4fd
SHA12f6bca0a9d09a1928f139a8a2e0cc872f4284fe7
SHA25688e4053e376c6597edc6533584b2f2fa3905237fe5db61867e8ee71c3a9e9f5d
SHA512732b217963e415fb272556731cf8503df431dbc450f6caf59b7c47804c650baebd33735d9fee18537bac37d639f4491a168351fa4b431457f62bae0e219de6fa
-
Filesize
2.5MB
MD5d9bc11c23aa360311d6b237b23b0c4fd
SHA12f6bca0a9d09a1928f139a8a2e0cc872f4284fe7
SHA25688e4053e376c6597edc6533584b2f2fa3905237fe5db61867e8ee71c3a9e9f5d
SHA512732b217963e415fb272556731cf8503df431dbc450f6caf59b7c47804c650baebd33735d9fee18537bac37d639f4491a168351fa4b431457f62bae0e219de6fa
-
Filesize
32B
MD57ebba17ad01ef8b82fe01c5a15a31634
SHA129f8ac51d89a7d3f300e765685f5230edb0c9752
SHA256bd583fdedda922bfc385b7872db9329d4d61c4548852fa8207ebe72b5af8eb2e
SHA51205bdb5e1d7e4429c0b33b13fd29f43b92d174260480348e12fb3dbe0f603dc44146db142cbf3bbc5ef09e6f7d86a269abba15d4ce0a80bffa9c38e31af33e04e
-
Filesize
32B
MD5d03f6a84b07a97dd09a27efb9acd8d1d
SHA13e27d5f859bdd0822dfacdb5510ee88dd2834496
SHA256749be0285d916625e06e0b5273889c2ede421b1f16f765cf817870fcec8c2930
SHA512659db10eb03cb17a4dea5190889d9723a7a7cb705b11685f5912f3ea667375ae2502e5c6101b07687ef48f03902e9b1fa890c9e328947626528dca485a21018a
-
Filesize
1.9MB
MD586e39e9161c3d930d93822f1563c280d
SHA1f5944df4142983714a6d9955e6e393d9876c1e11
SHA2560b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
SHA5120a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
-
Filesize
1.9MB
MD586e39e9161c3d930d93822f1563c280d
SHA1f5944df4142983714a6d9955e6e393d9876c1e11
SHA2560b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
SHA5120a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
3.6MB
MD593d87952773a2bb59a8667d0bc06c2c0
SHA1480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA2569ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
-
Filesize
251KB
MD523767288e6a003aaaa54355cbe108da8
SHA1c7f21dc71491fe661c698f5c561405c0e3f423c1
SHA256209135c082a8ef8323479384e97d769d9b2d98f727bbb34a7806ce150b750c89
SHA512a870b2f99da48ad07f9b36d6730d74af5f285af12e21a24d61e6e3023d5917920bd343fe295b7374a2065bf9c09b6f1cbb03fbcf05206f4bd0544b5f0eb0e147
-
Filesize
251KB
MD523767288e6a003aaaa54355cbe108da8
SHA1c7f21dc71491fe661c698f5c561405c0e3f423c1
SHA256209135c082a8ef8323479384e97d769d9b2d98f727bbb34a7806ce150b750c89
SHA512a870b2f99da48ad07f9b36d6730d74af5f285af12e21a24d61e6e3023d5917920bd343fe295b7374a2065bf9c09b6f1cbb03fbcf05206f4bd0544b5f0eb0e147
-
Filesize
2.6MB
MD50cd1ac870ce8fa3ad7a43e49ed6ef45c
SHA1e61d15d087dfc6f6610896db03f3645345134091
SHA25694209d7ff2428207aa86bfa1cc88b8b1cbbad47d50e6a70277219e27db34ee71
SHA5129e478818195ffeca95560b24e6a1eace28021bc78ac5dd4033b02760791a6950907809adf492d93d2a7d48e3d845fd30a9cd45ffb5777bbb9ed21a93ddfa8fa4
-
Filesize
2.5MB
MD5d9bc11c23aa360311d6b237b23b0c4fd
SHA12f6bca0a9d09a1928f139a8a2e0cc872f4284fe7
SHA25688e4053e376c6597edc6533584b2f2fa3905237fe5db61867e8ee71c3a9e9f5d
SHA512732b217963e415fb272556731cf8503df431dbc450f6caf59b7c47804c650baebd33735d9fee18537bac37d639f4491a168351fa4b431457f62bae0e219de6fa
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
4KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
708KB
-
Filesize
708KB
-
Filesize
4KB
-
Filesize
708KB