1b6d325cd8cde383bc8d33f8e2ad9c4426ebb3ff5a04e76fb31eacc1748e26bd

Analysis

max time kernel
132s
max time network
35s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
13-06-2023 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sadx_setup.exe
Size

3.0MB
MD5

b070567e2972df28aaec1370314a813e
SHA1

6f4bc56235e6f966e012ca7843552db07e894bce
SHA256

1b6d325cd8cde383bc8d33f8e2ad9c4426ebb3ff5a04e76fb31eacc1748e26bd
SHA512

7e05a8954292cd0c4f0289036a031817b7fb6404669d93a8d759e2a5a482eabeaf0fbe9400d6f5970362e53f02bc97c654f5eda759b5bc03b6a35ff4a9b5816b
SSDEEP

49152:cTojOdCldPAtnvOg3O2GwKOAbv7HtL+5sby5AlUg+bRM+NUjl7xnZAF8FvnUGeRj:eIBlYvOgSOgHNagy5Al+bRMaUxdZAFgu

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1052	sadx_setup.exe
1052	sadx_setup.exe
1052	sadx_setup.exe
1052	sadx_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1052	sadx_setup.exe
1052	sadx_setup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1052	sadx_setup.exe

C:\Users\Admin\AppData\Local\Temp\sadx_setup.exe
"C:\Users\Admin\AppData\Local\Temp\sadx_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst25EA.tmp\nsProcess.dll

Filesize
4KB

MD5
faa7f034b38e729a983965c04cc70fc1

SHA1
df8bda55b498976ea47d25d8a77539b049dab55e

SHA256
579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf

SHA512
7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf

Download Submit
\Users\Admin\AppData\Local\Temp\nst25EA.tmp\LangDLL.dll

Filesize
5KB

MD5
014a3be4a7c1ccb217916dbf4f222bd1

SHA1
9b4c41eb0e84886beb5591d8357155e27f9c68ed

SHA256
09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8

SHA512
0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922

Download Submit
\Users\Admin\AppData\Local\Temp\nst25EA.tmp\System.dll

Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
\Users\Admin\AppData\Local\Temp\nst25EA.tmp\nsDialogs.dll

Filesize
9KB

MD5
48f3e7860e1de2b4e63ec744a5e9582a

SHA1
420c64d802a637c75a53efc8f748e1aede3d6dc6

SHA256
6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156

SHA512
28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583

Download Submit
\Users\Admin\AppData\Local\Temp\nst25EA.tmp\nsProcess.dll

Filesize
4KB

MD5
faa7f034b38e729a983965c04cc70fc1

SHA1
df8bda55b498976ea47d25d8a77539b049dab55e

SHA256
579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf

SHA512
7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf

Download Submit