Overview
overview
10Static
static
3Installer-...ed.zip
windows7-x64
1Installer-...ed.zip
windows10-1703-x64
1Installer-...ed.zip
windows10-2004-x64
1Installer-...ed.zip
windows11-21h2-x64
1Installer-...ed.zip
macos-10.15-amd64
1Installer-...ed.zip
debian-9-armhf
Installer-...ed.zip
debian-9-mips
Installer-...ed.zip
debian-9-mipsel
Installer-...ed.zip
ubuntu-18.04-amd64
0x000a0000...53.exe
windows7-x64
10x000a0000...53.exe
windows10-1703-x64
80x000a0000...53.exe
windows10-2004-x64
100x000a0000...53.exe
windows11-21h2-x64
80x000a0000...53.exe
macos-10.15-amd64
10x000a0000...53.exe
debian-9-armhf
0x000a0000...53.exe
debian-9-mips
0x000a0000...53.exe
debian-9-mipsel
0x000a0000...53.exe
ubuntu-18.04-amd64
Analysis
-
max time kernel
89s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2024 05:08
Static task
static1
Behavioral task
behavioral1
Sample
Installer-Advanced-Installergenius_v4.8z.1l.exe_pw_infected.zip
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Installer-Advanced-Installergenius_v4.8z.1l.exe_pw_infected.zip
Resource
win10-20240214-en
Behavioral task
behavioral3
Sample
Installer-Advanced-Installergenius_v4.8z.1l.exe_pw_infected.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral4
Sample
Installer-Advanced-Installergenius_v4.8z.1l.exe_pw_infected.zip
Resource
win11-20240214-en
Behavioral task
behavioral5
Sample
Installer-Advanced-Installergenius_v4.8z.1l.exe_pw_infected.zip
Resource
macos-20240214-en
Behavioral task
behavioral6
Sample
Installer-Advanced-Installergenius_v4.8z.1l.exe_pw_infected.zip
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral7
Sample
Installer-Advanced-Installergenius_v4.8z.1l.exe_pw_infected.zip
Resource
debian9-mipsbe-20231222-en
Behavioral task
behavioral8
Sample
Installer-Advanced-Installergenius_v4.8z.1l.exe_pw_infected.zip
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral9
Sample
Installer-Advanced-Installergenius_v4.8z.1l.exe_pw_infected.zip
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral10
Sample
0x000a000000023656-53.exe
Resource
win7-20231215-en
Behavioral task
behavioral11
Sample
0x000a000000023656-53.exe
Resource
win10-20240214-en
Behavioral task
behavioral12
Sample
0x000a000000023656-53.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
0x000a000000023656-53.exe
Resource
win11-20240214-en
Behavioral task
behavioral14
Sample
0x000a000000023656-53.exe
Resource
macos-20240214-en
Behavioral task
behavioral15
Sample
0x000a000000023656-53.exe
Resource
debian9-armhf-20231221-en
Behavioral task
behavioral16
Sample
0x000a000000023656-53.exe
Resource
debian9-mipsbe-20231222-en
Behavioral task
behavioral17
Sample
0x000a000000023656-53.exe
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral18
Sample
0x000a000000023656-53.exe
Resource
ubuntu1804-amd64-20231215-en
General
-
Target
0x000a000000023656-53.exe
-
Size
686.9MB
-
MD5
3abe8b51f5087787b9c121b10f37108b
-
SHA1
4cb1fc54dc24f175c744a958e74ff84b5fb16d4e
-
SHA256
7ba93fe544def71fa435ae70911356845d19d5fcee1df71369aa537fe848c5d5
-
SHA512
fcee37f1e56aed457f71aa0c54f320e28a308c002d639bcd424389cb464ce18103746b470456f5824b28d079cead670bdcb8d691d8bed864544ffbfe2c75fed4
-
SSDEEP
1572864:jnhUzyh7u4k9pJmoLKAwhzTICA8VjcDJSx:jnikUDUzPAUj3x
Malware Config
Extracted
lumma
https://gemcreedarticulateod.shop/api
https://secretionsuitcasenioise.shop/api
https://claimconcessionrebe.shop/api
https://liabilityarrangemenyit.shop/api
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 67 4800 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
Processes:
powershell.exepid process 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 4800 set thread context of 2564 4800 powershell.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3020 2564 WerFault.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
0x000a000000023656-53.exepowershell.exepid process 4748 0x000a000000023656-53.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
0x000a000000023656-53.exepowershell.exedescription pid process Token: SeDebugPrivilege 4748 0x000a000000023656-53.exe Token: SeDebugPrivilege 4800 powershell.exe Token: SeShutdownPrivilege 4800 powershell.exe Token: SeCreatePagefilePrivilege 4800 powershell.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
0x000a000000023656-53.exepowershell.exedescription pid process target process PID 4748 wrote to memory of 4800 4748 0x000a000000023656-53.exe powershell.exe PID 4748 wrote to memory of 4800 4748 0x000a000000023656-53.exe powershell.exe PID 4748 wrote to memory of 4800 4748 0x000a000000023656-53.exe powershell.exe PID 4800 wrote to memory of 2564 4800 powershell.exe AppLaunch.exe PID 4800 wrote to memory of 2564 4800 powershell.exe AppLaunch.exe PID 4800 wrote to memory of 2564 4800 powershell.exe AppLaunch.exe PID 4800 wrote to memory of 2564 4800 powershell.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000a000000023656-53.exe"C:\Users\Admin\AppData\Local\Temp\0x000a000000023656-53.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 10284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2564 -ip 25641⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iy13o0uq.4ox.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2564-46-0x000000000E970000-0x000000000EA06000-memory.dmpFilesize
600KB
-
memory/2564-44-0x000000000ECB0000-0x000000000ECE2000-memory.dmpFilesize
200KB
-
memory/2564-41-0x000000000ECB0000-0x000000000ECE2000-memory.dmpFilesize
200KB
-
memory/2564-43-0x000000000ECB0000-0x000000000ECE2000-memory.dmpFilesize
200KB
-
memory/2564-42-0x000000000ECB0000-0x000000000ECE2000-memory.dmpFilesize
200KB
-
memory/2564-40-0x000000000E970000-0x000000000EA06000-memory.dmpFilesize
600KB
-
memory/4748-9-0x0000000048B60000-0x0000000048BFC000-memory.dmpFilesize
624KB
-
memory/4748-8-0x0000000030C80000-0x0000000030CE6000-memory.dmpFilesize
408KB
-
memory/4748-0-0x0000000074B30000-0x00000000752E0000-memory.dmpFilesize
7.7MB
-
memory/4748-10-0x0000000030770000-0x0000000030780000-memory.dmpFilesize
64KB
-
memory/4748-48-0x0000000074B30000-0x00000000752E0000-memory.dmpFilesize
7.7MB
-
memory/4748-1-0x0000000000E10000-0x0000000001E10000-memory.dmpFilesize
16.0MB
-
memory/4748-2-0x0000000030770000-0x0000000030780000-memory.dmpFilesize
64KB
-
memory/4748-3-0x0000000030D30000-0x00000000312D4000-memory.dmpFilesize
5.6MB
-
memory/4748-4-0x0000000030780000-0x0000000030812000-memory.dmpFilesize
584KB
-
memory/4748-5-0x00000000309D0000-0x0000000030B76000-memory.dmpFilesize
1.6MB
-
memory/4748-6-0x0000000030730000-0x000000003073A000-memory.dmpFilesize
40KB
-
memory/4748-7-0x0000000074B30000-0x00000000752E0000-memory.dmpFilesize
7.7MB
-
memory/4800-30-0x0000000006E20000-0x0000000006E64000-memory.dmpFilesize
272KB
-
memory/4800-36-0x0000000015AA0000-0x0000000015AC2000-memory.dmpFilesize
136KB
-
memory/4800-29-0x00000000068E0000-0x000000000692C000-memory.dmpFilesize
304KB
-
memory/4800-27-0x00000000062A0000-0x00000000065F4000-memory.dmpFilesize
3.3MB
-
memory/4800-31-0x0000000002F90000-0x0000000002FA0000-memory.dmpFilesize
64KB
-
memory/4800-32-0x0000000007BA0000-0x0000000007C16000-memory.dmpFilesize
472KB
-
memory/4800-33-0x00000000082A0000-0x000000000891A000-memory.dmpFilesize
6.5MB
-
memory/4800-34-0x0000000007C40000-0x0000000007C5A000-memory.dmpFilesize
104KB
-
memory/4800-35-0x0000000007F50000-0x0000000008060000-memory.dmpFilesize
1.1MB
-
memory/4800-28-0x00000000068A0000-0x00000000068BE000-memory.dmpFilesize
120KB
-
memory/4800-37-0x0000000002F90000-0x0000000002FA0000-memory.dmpFilesize
64KB
-
memory/4800-17-0x00000000061C0000-0x0000000006226000-memory.dmpFilesize
408KB
-
memory/4800-16-0x00000000059D0000-0x00000000059F2000-memory.dmpFilesize
136KB
-
memory/4800-15-0x0000000005B20000-0x0000000006148000-memory.dmpFilesize
6.2MB
-
memory/4800-14-0x0000000002F90000-0x0000000002FA0000-memory.dmpFilesize
64KB
-
memory/4800-13-0x0000000002F90000-0x0000000002FA0000-memory.dmpFilesize
64KB
-
memory/4800-45-0x0000000074B30000-0x00000000752E0000-memory.dmpFilesize
7.7MB
-
memory/4800-12-0x0000000074B30000-0x00000000752E0000-memory.dmpFilesize
7.7MB
-
memory/4800-11-0x0000000002F50000-0x0000000002F86000-memory.dmpFilesize
216KB