Analysis
-
max time kernel
322s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
06-06-2023 06:52
General
-
Target
Setup_WinThruster_2021.exe
-
Size
5.5MB
-
MD5
d07ccea4f401887ff1106c08c42e8110
-
SHA1
79510087ee93e64cbbcb930ef6e61e620d619539
-
SHA256
a6936625e74d09e2118a9b0a475bf9391495f047f046f7b63cfc319adebbc25f
-
SHA512
96841848dafa59b9dc1f963c04550e72b2bb8a30818f90c639b2aff5978322b077c84bea0204b6027fc591f9914f9df8e5a4cac13e7059eba9795dc261b03e1a
-
SSDEEP
98304:DEU2EBrTRE1MVZeEEsAD6bm2DH0zjIQ1cMYo8C4EsgB:AsHRoMVENfgVMR8ztQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2021.exe"C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2021.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-LO95R.tmp\Setup_WinThruster_2021.tmp"C:\Users\Admin\AppData\Local\Temp\is-LO95R.tmp\Setup_WinThruster_2021.tmp" /SL5="$80022,5031305,780800,C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2021.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD58b6183936cdeaa7be9a3e646f826057a
SHA186543f76db3a131956a6e06c3c06ae7be9ed9462
SHA256ef6f75ae2f1893254e9329ad9a5b77df33a8d501cebf3414447c6767fb0d7681
SHA51290a34c5e01cf3dcf62e4367cafe8b98e0b15a6d6588211c2256a405b5a3d6ef91a682c1979626dba37bc815f48e684fe1e07051ee4d686799422c44b246f14e2
-
Filesize
2.5MB
MD58b6183936cdeaa7be9a3e646f826057a
SHA186543f76db3a131956a6e06c3c06ae7be9ed9462
SHA256ef6f75ae2f1893254e9329ad9a5b77df33a8d501cebf3414447c6767fb0d7681
SHA51290a34c5e01cf3dcf62e4367cafe8b98e0b15a6d6588211c2256a405b5a3d6ef91a682c1979626dba37bc815f48e684fe1e07051ee4d686799422c44b246f14e2
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
4KB