f64de4aee0bc21db63da573ccb97b7d9a8d1e8dfc29bef72d8c8f26c4ec640cc

Analysis

max time kernel
138s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 3.3MB
Sample240203-edmf8sgdc9
SHA256 171ed103f3bec69d8f6b119648b3bdfa8a2db02db75fabb3b752209cb51c3ebc
MD5 f26b01e2b0be1463ca5e344b6f2c1a97
SHA1 69b2875969fe6b6307f2f8cd04e57d9adf94f05e
SHA512 2495f256278f72016725e522406713a8505e721f64cc48571faa78539142c68dd7c5d94105570c8a0c8435b33f3f290adb16ca2ef39564f6fd8a0dd8c809b530
SSDEEP 98304:nP1CXQNTu7+5TT0PKqD4m6CT2aYNWpqTXY++rgiSlOq/hu:tCXQy+1giqDj2hGQY+3ROgu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4436	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvF984.tmp\NSISdl.dll
Size 12KB
SHA256 17055e463a04435bdb5fea5d634af12a4678ff5d680196da230879ad24622ee3
MD5 a10c9c9f5474ed8c13ff5e182655eb9f
SHA1 ffa6073f6b1724183d570c368c3025430de1ee33
SHA512 bd7222d4ee6516b9be7f498858812ebfa824f657ef5298cfc813ad91fdfb6129642232d4c47f2edc4c2b8d2619ba7530a5195d53e9017435e7e8ef742f60fdb5
SSDEEP 192:ATPN9E1B0OUrW7VymsS9WmaYqkzJqa5Maamy6J0WVpzuzzPzrR2Z+:ATzEbUrW9tWmaY/zJ+aFy6CWVUzDP8
MD5 SHA1 SHA512 SSDEEP

Submit Download