f07bf397abd8b6bed01b838c3f332319c997f810ee5ec5087e761f1ccc39641a

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lnstall.exe
Size

1.4MB
MD5

38901633c833cba7f682472ced0dbe4b
SHA1

0c11a1ac834d2b270ba60f3605109933ca11a7f0
SHA256

a5c5487194f761dac90e178c9c1753c0f47b041f3168b5c23a587f33f69e5089
SHA512

70d71197c68c9a92883c482aee76978e2a01e785be6fb3b6082369e25d991d3e03d8467e11d87493e54f5a3dc4bcd59fa588f0fabe5f6fdcf3361de95cb471c1
SSDEEP

24576:gLikjHtEvSKi9Q8K8Nj99HxJ+EbUUbnI11f4wuTLoYHTkPQ4JD7eK:gukT+SpRKaJb0f4wrCSP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2684 set thread context of 2836	2684	lnstall.exe	29

Loads dropped DLL 2 IoCs

pid	Process
2836	cmd.exe
2616	updater.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2684	lnstall.exe
2684	lnstall.exe
2836	cmd.exe
2836	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2684	lnstall.exe
2836	cmd.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2836	2684	lnstall.exe	29
PID 2684 wrote to memory of 2836	2684	lnstall.exe	29
PID 2684 wrote to memory of 2836	2684	lnstall.exe	29
PID 2684 wrote to memory of 2836	2684	lnstall.exe	29
PID 2684 wrote to memory of 2836	2684	lnstall.exe	29
PID 2836 wrote to memory of 2616	2836	cmd.exe	31
PID 2836 wrote to memory of 2616	2836	cmd.exe	31
PID 2836 wrote to memory of 2616	2836	cmd.exe	31
PID 2836 wrote to memory of 2616	2836	cmd.exe	31
PID 2836 wrote to memory of 2616	2836	cmd.exe	31
PID 2836 wrote to memory of 2616	2836	cmd.exe	31
PID 2836 wrote to memory of 2616	2836	cmd.exe	31
PID 2836 wrote to memory of 2616	2836	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\lnstall.exe
"C:\Users\Admin\AppData\Local\Temp\lnstall.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\updater.exe
    C:\Users\Admin\AppData\Local\Temp\updater.exe
    3⤵
    - Loads dropped DLL
    PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2b1db400

Filesize
2.5MB

MD5
93422de273b0a4b66434c11311e53c12

SHA1
4571d58cf5bff78de047c8fd67b2c75383e6a9e1

SHA256
f475d7639d503935fa62461cde7d71ac3f4db6434bec4eb3237aba5b06c35ebf

SHA512
e6c3f1de318ac7ed3e45ac4550a24753777e058d85b5cb522fded2ee38b81a7f047c0c5eda36edf415244537ceda7ae3130728ac0c804c21a69a8b9da010ce0d

Download Submit
\Users\Admin\AppData\Local\Temp\updater.exe

Filesize
1.2MB

MD5
76fa2d81e19922704da81c94a187fed6

SHA1
b54d07cded2556aa544dc28a033678309389af98

SHA256
c57a6242ec7a796324b218c156586d52e06cf621376d955e6bd8ed5caefa26c9

SHA512
77aa53bace7dc39b864581cfdb69125969ddb43671676a3416283d346a328c348a96effa37a9ea39e185f46cb229e728a7bae5cf9cd464cf5e14b08eaccb4cdf

Download Submit
memory/2616-23-0x00000000002B0000-0x000000000035A000-memory.dmp

Filesize
680KB

Download
memory/2616-22-0x0000000076E10000-0x0000000076FB9000-memory.dmp

Filesize
1.7MB

Download
memory/2616-29-0x0000000000180000-0x00000000002AC000-memory.dmp

Filesize
1.2MB

Download
memory/2616-28-0x0000000000180000-0x00000000002AC000-memory.dmp

Filesize
1.2MB

Download
memory/2616-26-0x00000000002B0000-0x000000000035A000-memory.dmp

Filesize
680KB

Download
memory/2684-0-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/2684-1-0x0000000076E10000-0x0000000076FB9000-memory.dmp

Filesize
1.7MB

Download
memory/2684-8-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/2684-7-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/2836-17-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/2836-20-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/2836-14-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/2836-12-0x0000000076E10000-0x0000000076FB9000-memory.dmp

Filesize
1.7MB

Download
memory/2836-10-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download