Analysis

  • max time kernel
    92s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 17:47

General

  • Target

    MainInstaller.exe

  • Size

    531KB

  • MD5

    9ce448dcd7cf13dd950725957361bdff

  • SHA1

    5831ff31825ea82d90a2989e0fc0a33b859d5f97

  • SHA256

    3dbc5aff076ef9c86a90ad30e963581f7cb22f8e212aa38db29d82cf45b73f80

  • SHA512

    b4a175da3677cd3380cb3789f281f2afb10aa00dc9592217062d66eb9b5e73805886b692975d7244cdd439d8d5bcd0eb5810533284ba4b13ff02a20b792bf74f

  • SSDEEP

    12288:z/8Ze69hm2S17Y/bv9VXXLVS+n28L6OdBCZrrf3xSEowuj6ZQM7gMWZQkN:zihc17YpVE+PGsB03xSEowuj6ZQM71WD

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Users\Admin\AppData\Local\Temp\Setup.exe
      C:\Users\Admin\AppData\Local\Temp\Setup.exe /PID=0 /NOTIFY=0 /FFR=1 /FFP=1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1472

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Setup.exe

          Filesize

          505KB

          MD5

          5d8d0c08384ad73216d52a2eabc064f5

          SHA1

          0fa5c77fd6b6323b926c9648679e063d1bbc8bcc

          SHA256

          30522715240f4a05859099ac370dfb516097ab257402981c6a9ad31951f36cce

          SHA512

          42a3003019e39622082506c7ae50d8a27e2920fdfdf15eb9a8dbf7f1dbd49a02cd0390dabd74c136ed44e9d8ba270540ce9390f31aa84c2fc9fdfcc9e912dd57

        • C:\Users\Admin\AppData\Local\Temp\nsnBF4A.tmp\InstallOptions.dll

          Filesize

          14KB

          MD5

          325b008aec81e5aaa57096f05d4212b5

          SHA1

          27a2d89747a20305b6518438eff5b9f57f7df5c3

          SHA256

          c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

          SHA512

          18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

        • C:\Users\Admin\AppData\Local\Temp\nsnBF4A.tmp\ioSpecial.ini

          Filesize

          694B

          MD5

          4fa16a921ba6832a1445776615385066

          SHA1

          676bf65fd355e3e5ced8e7254db0a8de01be4d5e

          SHA256

          61bf7888565d2250b1d8488f442f91af997f060686a08ad942de46c16850bbbb

          SHA512

          2bfa2dbf0161338ecd61de19e1b077029dc97645086d651dda837c15c92a95852dd507a7fb872df6024fd83b6fdc9c24dbe8e76a0b729f27dd855b71b6ac7fb7