656ef859faec9bbf45e9507e05e46c23370e166cac188c047a6592e9abad6d3d

Analysis

max time kernel
142s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-04-2023 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eagleget_setup.exe
Size

10.1MB
MD5

9362466cebe90e227124d734ca8331d6
SHA1

c5c87d53699139e5409fc125aeeb5038ad8a36ed
SHA256

656ef859faec9bbf45e9507e05e46c23370e166cac188c047a6592e9abad6d3d
SHA512

290e193b1b136eeb782875de8087659c1be9223aeaf787a6f4ae7c8ffcdcdaf727ff132752764c946cfda72bfacac8edefe50c3a413f6a6a3b29c3219e21b18c
SSDEEP

196608:Oem68ZtdVwynNUtlT8kaTtDsDftJTz2Dni4E089ApMajJuodoPLCEXyjVjr:Oel8ZTVBMTx+DEtlap6ipMkJLoPCjV3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1672	eagleget_setup.tmp

Loads dropped DLL 4 IoCs

pid	Process
1544	eagleget_setup.exe
1672	eagleget_setup.tmp
1672	eagleget_setup.tmp
1672	eagleget_setup.tmp

Kills process with taskkill 1 IoCs

evasion

pid	Process
868	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	868	taskkill.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1672	1544	eagleget_setup.exe	28
PID 1544 wrote to memory of 1672	1544	eagleget_setup.exe	28
PID 1544 wrote to memory of 1672	1544	eagleget_setup.exe	28
PID 1544 wrote to memory of 1672	1544	eagleget_setup.exe	28
PID 1544 wrote to memory of 1672	1544	eagleget_setup.exe	28
PID 1544 wrote to memory of 1672	1544	eagleget_setup.exe	28
PID 1544 wrote to memory of 1672	1544	eagleget_setup.exe	28
PID 1672 wrote to memory of 868	1672	eagleget_setup.tmp	29
PID 1672 wrote to memory of 868	1672	eagleget_setup.tmp	29
PID 1672 wrote to memory of 868	1672	eagleget_setup.tmp	29
PID 1672 wrote to memory of 868	1672	eagleget_setup.tmp	29

C:\Users\Admin\AppData\Local\Temp\eagleget_setup.exe
"C:\Users\Admin\AppData\Local\Temp\eagleget_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\is-H23R7.tmp\eagleget_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-H23R7.tmp\eagleget_setup.tmp" /SL5="$70128,10160016,175104,C:\Users\Admin\AppData\Local\Temp\eagleget_setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill.exe" /f /im "net_updater32.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-CB5D3.tmp\back.png

Filesize
2KB

MD5
ef9ed169ba900bc5250d0210d25619e3

SHA1
d333ee23b4441e7da0109886159f7c9e78819c5c

SHA256
806f42fddd09b24993ec053e6fdcae023e4833b371590843a498aacac20b8c7c

SHA512
042e7fef639b74e421ab456e41301dedd1a91f29795b5594eea89ee95ff6c44b3f72936e639f8671bba3874fb6f536c7ef01bc878c5e3a1bdc1e73ae2f716267

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CB5D3.tmp\btn_browser.png

Filesize
2KB

MD5
8dd4f9f2c22073544694eca39c4f305d

SHA1
f7944cd8aa4f4b5233867dbdcea034a8d4be69e2

SHA256
0f6e9827ef681b88722d2013ae44fe5f8eeeaf22b6fe64904ecd0852de8197c8

SHA512
1c8708c77e8e61659ad7a903a4b5431e72532645486ca62e9b84d42f2e1fce2ebf07d17b64241656e08f32d766843dea6bc40fe7e8ff6e010201de8860a0d189

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CB5D3.tmp\btn_close.png

Filesize
204B

MD5
b780d58e26ddf76733743501d00123d4

SHA1
594b7196378628bcc7107e8186e2f2f6da07ac0b

SHA256
8a6026306c1774d027022b3ee600c34b296ab8135f46c872d74c734baa239eac

SHA512
8691a1c2a00311f31224fee23803a91bc2a7597aa2ac928cfc43291b7c6cfd89bce7f7fd60d8448603b5c441ff2706f9686e1fa71c56041d0c5377eb1e14ba5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CB5D3.tmp\btn_min.png

Filesize
103B

MD5
2e9c0f6a83184050751c5cb0dfae2397

SHA1
f1c3e7a900db6572ac0940b833b1ec30141bc17d

SHA256
686967328122f54acd92f85f6c162d42a8f607148f511ec4f7ab41010fc7db66

SHA512
03256bfcf0df9e390e1cfa1b4571aece489270d6c72f231db1c0a1d22b9c181a89fb2865810af217956b052eb47f34d5636edef4606074f607203358370ffc90

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CB5D3.tmp\btn_n.png

Filesize
1KB

MD5
66deff37283bca24ea963ae3a3963b38

SHA1
6c2410db0d9d77ed8019c01d68cb9fcdfa93b330

SHA256
d9f0859f6a5648b0a9060200cc9a7534161e1b22844f631766e4e3540090790a

SHA512
706a5f2b297694f48f623ba3ab9b0cbadd4a48be9d3b619ec76cf0aadf1638134d65a8de492b869573c136665778bfe86133cb9973d47f29f95683c4bb83faa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CB5D3.tmp\btn_setup.png

Filesize
4KB

MD5
212afbaedaa752a5e8957a609a0ae9f1

SHA1
73e210e0fdd3ac797e6b30bb57a17f2ddd195002

SHA256
d95a68be5109a23db0d0dff20ba3453ca69d39f48f2ae996255b84557a96881b

SHA512
b83e22c50f011f2bb42ea6936bd2b776d9371c933119a7aa19181cb2a3f7e050478c8e679410aea39ecc750b408ecf55fd927bad1234fa041a89ebd737ac5061

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CB5D3.tmp\checkboxdeep.png

Filesize
351B

MD5
3f5325a8962d480ccb89be73e7e054b5

SHA1
319e2f9e1c6c681f79265f6b24606574cbbeebbc

SHA256
ecfe768ec009c8cb24edb1dd3cfe8a8e8a583fcfc90ec90442ce1c8d59241cdc

SHA512
5994ba26c4fdc4ae3a94af2e0e48e3e173c8094fa8b069bfa47b1403ba8283e2ee312f49c308eed2f0d9d244373577244c6d8e4495d4f91f8b6597fff90b4db1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CB5D3.tmp\license.png

Filesize
1KB

MD5
8277d98e048ba1adf360d63622f5b0bf

SHA1
0bdc270cd963b2b34e919250455062f782052a47

SHA256
9a004daa7630d4916c962e681f1a1f95db3ff476fe82272dc937f7ac200683a2

SHA512
5b8a354efe4073473a92118027b06d1fe599a422f395fbfa17ce0bf5c3a0cb94c7bfadb1c324e66829ad478e1561200259d32d05514fbaa22f6bbc3a90a8579a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CB5D3.tmp\xy.png

Filesize
11KB

MD5
e92f3fbf3876c4044722fd975281b3ff

SHA1
d92877cad872663616a48f25af291e8bffb246aa

SHA256
31137ad0ef19381e1778eb89b6cb9f70a9ee5244ad943ad494e1e57b18b48ab7

SHA512
46fdb373fe54ecf762adcba6a08a0e2e67080d97931fe1407d4f60b74921d9ef7d38ec7104271805635a015ba5230a09e16de60010aecc5c404ae376efddfac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H23R7.tmp\eagleget_setup.tmp

Filesize
1.2MB

MD5
eb42e5720e09cd014694a22c86929f5e

SHA1
b619dccd5e1deb090d8eae6c6bac5e5dae91fdfb

SHA256
4dc2d414277e497490d2009f370051298bccaa649d0a335b064269a0bb9bbbf3

SHA512
4f5ea3e32f7da75799b8067351a860f6c840dba8108c92d34d4be7d6b811140e6b2dd161ba4bd90df77dff41b74e1e85b536b3776cadb656018a1914acc3ee2f

Download Submit
\Users\Admin\AppData\Local\Temp\is-CB5D3.tmp\CallbackCtrl.dll

Filesize
4KB

MD5
f07e819ba2e46a897cfabf816d7557b2

SHA1
8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

SHA256
68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

SHA512
7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

Download Submit
\Users\Admin\AppData\Local\Temp\is-CB5D3.tmp\botva2.dll

Filesize
35KB

MD5
0177746573eed407f8dca8a9e441aa49

SHA1
6b462adf78059d26cbc56b3311e3b97fcb8d05f7

SHA256
a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

SHA512
d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

Download Submit
\Users\Admin\AppData\Local\Temp\is-CB5D3.tmp\util.dll

Filesize
1013KB

MD5
b87b80e55c218e30b6d130d881714efe

SHA1
00816ae02538f0a69fe57b27c6674ec03eb1238d

SHA256
6db10a3f85934cc8fc265922b3ed9ccfa724da19c6a50303c23bb379d0b9219a

SHA512
07071535af4910b4acaa4d7110312f6535539859c4d389ced409fe248fd970174b1731d1b741ed9d06f5bdbb52751b3835fb6b17f08c1fb537640a04833a228a

Download Submit
\Users\Admin\AppData\Local\Temp\is-H23R7.tmp\eagleget_setup.tmp

Filesize
1.2MB

MD5
eb42e5720e09cd014694a22c86929f5e

SHA1
b619dccd5e1deb090d8eae6c6bac5e5dae91fdfb

SHA256
4dc2d414277e497490d2009f370051298bccaa649d0a335b064269a0bb9bbbf3

SHA512
4f5ea3e32f7da75799b8067351a860f6c840dba8108c92d34d4be7d6b811140e6b2dd161ba4bd90df77dff41b74e1e85b536b3776cadb656018a1914acc3ee2f

Download Submit
memory/1544-155-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1544-54-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1672-69-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1672-107-0x0000000002190000-0x000000000219E000-memory.dmp

Filesize
56KB

Download
memory/1672-156-0x0000000000400000-0x000000000054E000-memory.dmp

Filesize
1.3MB

Download
memory/1672-157-0x0000000002190000-0x000000000219E000-memory.dmp

Filesize
56KB

Download
memory/1672-158-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download