11b160985512a52e0370df2e033ee365624938201c0a0c9ec43b18c1feb58c2e

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

901d946782b7cdcca330975a6729b6ca.exe
Size

325KB
MD5

901d946782b7cdcca330975a6729b6ca
SHA1

1316a5bfce6e0fe11ca479cf15313d3ffdd8230e
SHA256

11b160985512a52e0370df2e033ee365624938201c0a0c9ec43b18c1feb58c2e
SHA512

d81aa5b1696fd5988932571ba78bc79d0f5a526f680ae5501ff876141c9309d5123f2abfcb91346635bf685c4c9848c45174141ce702b11b0443ee3b6d8f0b90
SSDEEP

6144:Er1Bh9uEo2S1YnQmCX492DkwNP3qpYFDcYgQUskKWeFCEQOiCYOqmO5oe:Er1B3u6/eIo4ArVUBQCCYOqmO5oe

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
952	901d946782b7cdcca330975a6729b6ca.exe
952	901d946782b7cdcca330975a6729b6ca.exe
952	901d946782b7cdcca330975a6729b6ca.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	901d946782b7cdcca330975a6729b6ca.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	901d946782b7cdcca330975a6729b6ca.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
952	901d946782b7cdcca330975a6729b6ca.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 3028	952	901d946782b7cdcca330975a6729b6ca.exe	29
PID 952 wrote to memory of 3028	952	901d946782b7cdcca330975a6729b6ca.exe	29
PID 952 wrote to memory of 3028	952	901d946782b7cdcca330975a6729b6ca.exe	29
PID 952 wrote to memory of 3028	952	901d946782b7cdcca330975a6729b6ca.exe	29

C:\Users\Admin\AppData\Local\Temp\901d946782b7cdcca330975a6729b6ca.exe
"C:\Users\Admin\AppData\Local\Temp\901d946782b7cdcca330975a6729b6ca.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin9F8B.bat"
  2⤵
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\InstallMate\22155315\cfg\1.ini

Filesize
814B

MD5
bd5e1676bd73896be4774e1f5b1f3e28

SHA1
fa2fc102b6b4f56317e4af04c0373ffa369498fa

SHA256
4f38c3e2ff80b27b939625bb197d9972dce1ed130179349f6c213c6520461086

SHA512
c9e1d8a0e37f869b2d07b02152fdce80a9a15a4c4ce67ec50c494f0426e33f3f5a4af45a5e3efd297870bf18bee12f1ad0c68900a9fe46235f9c9f565d3f8b78

Download Submit
C:\ProgramData\InstallMate\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\Custom.dll

Filesize
59KB

MD5
05540c9920d602c69ff2781ea01eac29

SHA1
c43ecaa5c12bc9541115482f8a164ada8fdeb29a

SHA256
1aeb2c74ee76442b50816d039dec3ca7f231e5a6a762ff38fb79a3b0ce66e285

SHA512
0d995e9481767cd607e073e8665169600d44732678b1573fa880dc8123ed960593a3f588032a933fceef2b834d6a575419443fd5f5d5c2b44d159a02d15cbdff

Download Submit
C:\ProgramData\InstallMate\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\TsuDll.dll

Filesize
155KB

MD5
7b69064f9d8ed16762a75ee0d5a256cd

SHA1
cfbc959d936c81641ba7d8b220a3c42be26633e2

SHA256
d7e3abcc7181b60ab143138d97b54258693418ca0848db9621045dd7c7c8f988

SHA512
4b859da41e01bbef00292f6088b9948bd30a8520b0b3ae023e0580f07f75f5cd2875c599e18d02937114bdc5ac2bbe60f497adcf6df0619b55aec083635a454a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_tin9F8B.bat

Filesize
50B

MD5
e8085be36abd023c2ae7731c3f113d85

SHA1
d07bb13f261ac98b825a9f1f4de88d0d38c66df9

SHA256
94f5b7b53363318c555575e42974cb8850ef7552b0fff243f1fed2bd58fb68e0

SHA512
57f2ceae004ac94f4caf2c053f6c9e4d3621271cda2529eef7d369d3ea8c79d91ee1a70631da22ce5adbafde74adf585b50437ad86a3de4f90832c6e099b1799

Download Submit
C:\Users\Admin\AppData\Local\Temp\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\Readme.txt

Filesize
2KB

MD5
cb45f741900f51ed947f0c8061884c9f

SHA1
3c63ff4c2039094b8e86ae28d17968563061f62f

SHA256
6f1bd3c9e1ad5ed8b04a016ab26252627c47e527a75925080828db051387f3d5

SHA512
d42b62f1ad800968e19dcdd00658cd77c6106e740456b193d08141af974cf8e6f59c9551489922e160ae23a84e39d2132150fee8cf3a663d0db35516af957000

Download Submit
C:\Users\Admin\AppData\Local\Temp\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\Setup.exe

Filesize
15KB

MD5
e717f6ce3a7429bfa6d7f3cf66737a4b

SHA1
01f4042589b4ed88c351ffeac256be7a9d884818

SHA256
7be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633

SHA512
65a9a27430811aa01b55cf365f8b7b9f03e70d32ec60e0706242bc568242bcd493999dc1b02d92bf0d01c0095c8c38d30f282a998cafb80e60ad07e0d875ce80

Download Submit
C:\Users\Admin\AppData\Local\Temp\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\Setup.ico

Filesize
14KB

MD5
1623bb0c615eaeed406a3253a606e71c

SHA1
e86516e730bdd2a6d0423211f236f4ae9dd4282e

SHA256
67664b6561b8bf32091bca59db37a8c8099da01236accfa85f1367bdcb5f0904

SHA512
2d854d2732d9562acfe01350fbeb0b78339d01630f114f8c5f95f7542fff2af93393b5c4f977d9602d78dbea23bf41f2f1a9b0252e51a66971facf208803ec5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\_Setup.dll

Filesize
167KB

MD5
491646f23ccbd43f0bfe69e5d5bfe33e

SHA1
351ce0bb9306c91c11c1c795e6bd336bb5c4e09a

SHA256
b5a086b1341b9ed1adee6f2c98a77660eb076e09c1e4d5d4f51cba3e22409ba7

SHA512
47a828e5a4cb0566baeb06db27f8ff393612b1c63dd1e401b383ede5fd1b62510f52bfb4e66e6da6d5f5eb7121a016e0a364f6166b3ec13dffd483c650ccfb12

Download Submit
\Users\Admin\AppData\Local\Temp\TsuD268C42D.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
\Users\Admin\AppData\Local\Temp\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\Custom.dll

Filesize
91KB

MD5
736682c6d96bb1edc84e77041faae33d

SHA1
f8f6e20cd2aa23010b85ea289c3bc3cbdbc9ae26

SHA256
54346f2e36bdb512ef4f7d702f18e59a746f0b936786bc76a30e87de0a061f17

SHA512
fe24353f0f4acafbde7d8cec7a5078668f5e6cd0b06c3e0c96cb3fed0beb3c8af2becb1d97fcbb369ac38193827c8d8a440694c79b5da3180224377e38f53777

Download Submit
\Users\Admin\AppData\Local\Temp\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\_Setup.dll

Filesize
180KB

MD5
a475792794328d8a503568cbe38e8531

SHA1
47e5c4857f272898ed515e939f92cb9243b2ce2e

SHA256
2cd6c67a711059c2245615d80ee0e7d44a003b66d5577513b1dfb1bd7f1e7312

SHA512
3ea14ace569233dd69e730b4dfae4f1292d2e950aa26aceeae78715d0831ff6919d1bbf7c70ec256dd8a5db7f2d09ea4f29a564c125b54fdf8c7de2c78631184

Download Submit