df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a

Analysis

max time kernel
10s
max time network
127s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stremio+4.4.165.exe
Size

112.7MB
MD5

bb7ed7feaf8aebeb43ff9c376d0a8e22
SHA1

f0729b51043b8fb5edebddfd69c67c7b14ce01af
SHA256

df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a
SHA512

9984643c76ddeb8bb612ec86187a0b7a835e0b5f369137ef5a453fd2cadc5ea0d0c6fad21deeb60af5cb09fd9b9ec25fb9e090d394be3c242b99de512bfde465
SSDEEP

3145728:+YdpqKUfzM8/I/6Uj2jDxXz8sGd1TiDlSdgSbc+cYO5NCO1JT1:1doK18wiucDZxG7TOlSKSI+0NCO191

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2360	Stremio+4.4.165.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2360	Stremio+4.4.165.exe
2360	Stremio+4.4.165.exe

C:\Users\Admin\AppData\Local\Temp\Stremio+4.4.165.exe
"C:\Users\Admin\AppData\Local\Temp\Stremio+4.4.165.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\Uninstall.exe

Filesize
33KB

MD5
aece35498dc2004dd0cf42fb99e060c8

SHA1
1b38c4c32f08cfaf0a4cb8d49fcfa5b73ed58bc8

SHA256
311494d0ee9fe49c9e0af37423c088082734f3d8c1e0220921e1200effb2a999

SHA512
7ea42e955467d0b6e3a445d8255a4c9933a03e730c49543136211b962491dda26ac678d26ee22475e3f27e31b8f07b6e4c636de3ebb4064f78eec3bfc30d61d2

Download Submit
\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio.exe

Filesize
13KB

MD5
143c8f50bc9538324c47b821c14eb7b5

SHA1
b0573ea333704bff3f49fbb2c8479021f2a58408

SHA256
2d3c0c0de45aa60b818459a382a1ab7aae4139af75fa0f4d7365c86dfa65b328

SHA512
f7240c2e8b94152b8e74dcf77b99985f3646f021dbe75ad343154da978736912207b3ba5ba6b93d014b45bacf6915bcfc5be7b7a25eb8c47dd866503ff7beb72

Download Submit
\Users\Admin\AppData\Local\Temp\nsd16CC.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\nsd16CC.tmp\System.dll

Filesize
9KB

MD5
4d53d64de149daa5b4ae1c0e138c5970

SHA1
f26fb23a5a9db83f1218dd32d368f57f2f86b361

SHA256
8015fcf0b35937ed91aaeb7b6cacb5d627202ba7e2b5ad07867083d5c5b1fadc

SHA512
f3a403f71cc6e0f000f49678d5a4f70c638d7a284bfdba03fe2b9e192616a855acc2655c85bef0c87b5ffe955aa00b06ea0f1dc7893de96011340aeee18b9973

Download Submit
\Users\Admin\AppData\Local\Temp\nsd16CC.tmp\System.dll

Filesize
8KB

MD5
8bc0ef07020c2721c747a92552acafcf

SHA1
881348517a3c1284e2d99d789a5d1847d681cd19

SHA256
d6b7337e576a78d3ef7a74059d420d16ac73835a50e744d5879e23946b9782da

SHA512
0f755cf99306a26f9a8df5b41a07a5258795db763c8b40e8e42aa41ea594f702363e6cc54c1c38307d31dcc64d40504ca5307eaf9402676bc532a7a7142f99e4

Download Submit
\Users\Admin\AppData\Local\Temp\nsd16CC.tmp\System.dll

Filesize
4KB

MD5
bf820d6893cf40b44b118bee04786fd9

SHA1
eed1ff6a2fcd65ffa00d2bb28b62473042db7f4f

SHA256
fb2fbdae7f71ff3bfc2e115aa6c928b52e89e750e9678b17a0375a489e38bff1

SHA512
6510280e21cff4f3ba4450c9c6a53c7056c725429ac7e283b0661b13ad9ffcb2d5d91e8c41995318abade0e5c8e97f230c89d521e5eb068c195de0afa6c01357

Download Submit
\Users\Admin\AppData\Local\Temp\nsd16CC.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit