Analysis
-
max time kernel
278s -
max time network
376s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 11:47
Static task
static1
Behavioral task
behavioral1
Sample
Setup VirtualDJ v8.5.7131.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Setup VirtualDJ v8.5.7131.exe
Resource
win10v2004-20230915-en
General
-
Target
Setup VirtualDJ v8.5.7131.exe
-
Size
175.4MB
-
MD5
10af6247af602a77f658f37bb0f0e205
-
SHA1
9773469157241661d31cd0ba9489ec5c6acc3ef0
-
SHA256
2db88f53d61f4fe7503964c044ef930602c40e355fdfc169be8adbc6ddcc03bf
-
SHA512
c6f823051cd9da5d8dc7a204d8c4d0a9880fea3863d996256a6e15c7799308230c164dc6af8377176164ee4df7ee15de0390ea13f77e1c14e8774e770a7a59e6
-
SSDEEP
3145728:M7hru/r9WMa052wz3atts6KTFH4SK0r/t5/QO5a4XvBD0ndabJUATsv:M7lu/R/a052a3yuTiSbta4/BCdayH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2516 Setup VirtualDJ v8.5.7131.tmp -
Loads dropped DLL 4 IoCs
pid Process 1620 Setup VirtualDJ v8.5.7131.exe 2516 Setup VirtualDJ v8.5.7131.tmp 2516 Setup VirtualDJ v8.5.7131.tmp 2516 Setup VirtualDJ v8.5.7131.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2516 Setup VirtualDJ v8.5.7131.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2516 1620 Setup VirtualDJ v8.5.7131.exe 26 PID 1620 wrote to memory of 2516 1620 Setup VirtualDJ v8.5.7131.exe 26 PID 1620 wrote to memory of 2516 1620 Setup VirtualDJ v8.5.7131.exe 26 PID 1620 wrote to memory of 2516 1620 Setup VirtualDJ v8.5.7131.exe 26 PID 1620 wrote to memory of 2516 1620 Setup VirtualDJ v8.5.7131.exe 26 PID 1620 wrote to memory of 2516 1620 Setup VirtualDJ v8.5.7131.exe 26 PID 1620 wrote to memory of 2516 1620 Setup VirtualDJ v8.5.7131.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup VirtualDJ v8.5.7131.exe"C:\Users\Admin\AppData\Local\Temp\Setup VirtualDJ v8.5.7131.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\is-CU6DN.tmp\Setup VirtualDJ v8.5.7131.tmp"C:\Users\Admin\AppData\Local\Temp\is-CU6DN.tmp\Setup VirtualDJ v8.5.7131.tmp" /SL5="$70120,183528617,121344,C:\Users\Admin\AppData\Local\Temp\Setup VirtualDJ v8.5.7131.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2516
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
4KB
MD55df8ada84a16f5dfc24096ef90a5ce3a
SHA15e7e9c68119c3a0a1afc92c60674bc8714492823
SHA25648a9c8c332fde541b571d9d522d0e37834b452f55af8cbdc341b12222e78fb5b
SHA512661b5219c74dd6e3a8e899a1b1a3002689d148e337d7323a174519366c9548c284ee76e2faa2f9600cd483db21093ee62399f0d7403c39523c654266760191c2
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb