69bef682277aa8ed7ffdb645a8e41d1f1d279380cc799256132d0cac50582890

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$1/1337/ExLoader_Installer.exe
Size

19.8MB
MD5

afcb0e5c7c35c05970a74a1aab5fe12e
SHA1

42eacb7a9594ee0a6242d3bc3c33b6c60b3fc319
SHA256

f1e92828ebf9e2443f36c03a5a66a4fba4bd8744ecf5bbf59fc69c84d7a95d18
SHA512

fe62d4b1ec93a21a7b1f80e5f42b17c0c43d794b99e7e87fb6fea86d82ac080d76dcf9a3e96516303ccaf88b8101523a23f5b7f560bd3f4bb2745ac1f71b4dfb
SSDEEP

393216:QuTOvTuAnHmMgEMSb6qLdTcmtgt+BDMncawXAKaVnayxZtFDtq:dUTPGMzpbpT8+BInf46VnvHrJq

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ExLoader_Installer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Control Panel\International\Geo\Nation	ExLoader_Installer.exe

Executes dropped EXE 1 IoCs

Processes:

ExLoader_Installer.exe

pid process

1552 ExLoader_Installer.exe

pid	process
1552	ExLoader_Installer.exe

Loads dropped DLL 6 IoCs

Processes:

ExLoader_Installer.exeExLoader_Installer.exe

pid	process
2268	ExLoader_Installer.exe
1552	ExLoader_Installer.exe
1552	ExLoader_Installer.exe
1552	ExLoader_Installer.exe
1552	ExLoader_Installer.exe
1552	ExLoader_Installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ExLoader_Installer.exeExLoader_Installer.execmd.execmd.exe

description	pid	process	target process
PID 2268 wrote to memory of 1552	2268	ExLoader_Installer.exe	ExLoader_Installer.exe
PID 2268 wrote to memory of 1552	2268	ExLoader_Installer.exe	ExLoader_Installer.exe
PID 2268 wrote to memory of 1552	2268	ExLoader_Installer.exe	ExLoader_Installer.exe
PID 1552 wrote to memory of 2500	1552	ExLoader_Installer.exe	cmd.exe
PID 1552 wrote to memory of 2500	1552	ExLoader_Installer.exe	cmd.exe
PID 1552 wrote to memory of 2500	1552	ExLoader_Installer.exe	cmd.exe
PID 2500 wrote to memory of 1424	2500	cmd.exe	reg.exe
PID 2500 wrote to memory of 1424	2500	cmd.exe	reg.exe
PID 2500 wrote to memory of 1424	2500	cmd.exe	reg.exe
PID 1552 wrote to memory of 2284	1552	ExLoader_Installer.exe	cmd.exe
PID 1552 wrote to memory of 2284	1552	ExLoader_Installer.exe	cmd.exe
PID 1552 wrote to memory of 2284	1552	ExLoader_Installer.exe	cmd.exe
PID 2284 wrote to memory of 1528	2284	cmd.exe	reg.exe
PID 2284 wrote to memory of 1528	2284	cmd.exe	reg.exe
PID 2284 wrote to memory of 1528	2284	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\$1\1337\ExLoader_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\$1\1337\ExLoader_Installer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
3⤵
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\System32\reg.exe
C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
4⤵
PID:1424

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
3⤵
- Suspicious use of WriteProcessMemory
PID:2284

C:\Windows\System32\reg.exe
C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
4⤵
PID:1528

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\MSVCP140.dll
Filesize
320KB

MD5
bdf019c31240b561af544373f65102fd

SHA1
07beb5a61842190026ac4caccde4f1e70bf7334a

SHA256
562ed0eb451f01cdbcdd87eb0849a3c46096ad51a38b7e50921e0b435995d1b3

SHA512
8f50664656241ff7af3afc2f87ff089b8db400cfc4e7e3eabe8e0d24723432cafc82b4c592a714de424bb3ea09c0da0bb33a33c921377abcb652a87701c67448

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140.dll
Filesize
94KB

MD5
c8e5574247f5a2468f71b53fc0279594

SHA1
c28d7c9cad48882beaeed0fba15cbc11fc2f949c

SHA256
0373c0cd6856950dee1b1a9e3ddb896099c6c823f6e46dc00802fed19dbd58d0

SHA512
d244d3879cbdfd22bd94eb7d4950916b5999d6c012b0287a8807a110f1bc80266049f4d0563b97bb0154bcde7480ffcba07e9f7e66fc2ac20020e3c77792df81

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140_1.dll
Filesize
36KB

MD5
35628f1d136c003699382ea7d489cb16

SHA1
30dfd392927161182224f0e6b8aace235a00fbea

SHA256
0d6f93c5d19530a1623798f936468bc0934c1795545dd000b8812539b3e308cf

SHA512
558e6d729d39f25584191804e3b60f8fe8e9e950d58cd8f82eeaecb45c5bc86f2b9e9ac499ddabbee7dfe6a6ac6cb44cf63ced6e8105405ab9b314b5005d9cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\app.so
Filesize
5.6MB

MD5
8b4407bbba38a4faf6332d44b52c6eb9

SHA1
1851ef1c249d4cab7a696e3d9bff755c668b9676

SHA256
1051823b8bb74fd216f88994e059fbcfecdd6b9ef2891b47d0466edaf3de0776

SHA512
13956d458a7be6b61deee8b071d74888d1f15e6adda3fe63ba1947311f23b789eff63cf02111e730dbea0d931ad66a31fa5fd5a68ab9c78e9abe8ad2864bb815

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\AssetManifest.bin
Filesize
36KB

MD5
37319e9e5131c88c5169e044dfd432fb

SHA1
f8207003744b2cf6d6ebd6080c9afe5925904a0d

SHA256
f50d907a3487cfbff2fe04f6eca8f38c968d52c971c8044a9e9d39286becf735

SHA512
3e8750f329f936622e55162003b73a57a808db1a3c408fcabb0a3653c5126b0848e1df1b84bac54406b5c365b8a89cf4c29d41774c97b8c393457e308f994b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\FontManifest.json
Filesize
687B

MD5
08916680285af6ddf4adbd1dd265487d

SHA1
e5fa77912a69248aab08714c5b605df62c469f33

SHA256
ef252f80a090c0ae1499c34148c27f3e982100b25c8daa9921d102343383f751

SHA512
68c9858777147a6a1c4932c13149aba4bb97453a3aface4c80077a5746ed493c811e36cd89b838e34429e91b1833b1866177b4bfc216129d555f310fe71a108f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\backgrounds\Warcraft.jpg
Filesize
52KB

MD5
a48a77f8b3f8f7e6a9661776472b14c0

SHA1
7118461b780b558939a325a319e8515edbbedef1

SHA256
2e58bd1444d8452ba963e877601e8942a1560abdd44c16ed33580148322234ba

SHA512
f6a8a2844d872b650fc6342f809198bf078cf2d472c1b43f18529a0216393f6494202ab3b95ffef560fdba4bee7a4c6a85be49d9151cbd52c0c870d65c6e47fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\flags\RE.png
Filesize
2KB

MD5
23f2c7dc04bfe492598bc440f57114af

SHA1
c30b386b7138a1d89b90f0e679ef58f4c545ba42

SHA256
94a0c4bc3aa825e44d36b0a463f9bfb012c2156392594a8ac6d76b389776e3a9

SHA512
edbc28f9f61ad48ac02e1bcb0f862249b5baf352289e068cb5df5552b5e9752a205e7b093b7caedccf4230186659d4b12579433ae8141b5129a5a6cf4c6bc5f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\flags\SJ.png
Filesize
2KB

MD5
bf25a4249d34f915ec1a246a468290cc

SHA1
5cc47373c11ff0488929124e18e280c7eb36b232

SHA256
0dd0e0a0d72ff4179b11afd5367a72b000de4a5c5ea0362f1f1723f80a3a2d22

SHA512
982fbc34c0c0ccad148b6745185af317bbe12215e08c879c6a06a7073d2afbcbc70c4fed9e028cc91a6a1eaa1fece064dbddf415a4b97a799dbfb1debcc02337

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\Raleway-Black.ttf
Filesize
159KB

MD5
35e0e2e7a5b03275ba569a214edbab77

SHA1
b341b185db9c7231884558dcdab0124d2f5ed1d0

SHA256
2d1149ca6075e3559fa4234107474b3b500bc479baa0bdaa8a99563a587c62f5

SHA512
e3d752d8fd5a7306dcf8fc428b72df1668991b7152b66fba41e365cc61626f8ddfc8092dbcbc2b2ef3acea5c09496e83af2a2208cdd5b66e7ff3267b2bf2f0d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\Raleway-Bold.ttf
Filesize
159KB

MD5
88079335418f389bfb2d86bc4f1ced64

SHA1
fd799b6fb4aff1a9402e071ab02d1ddea731b868

SHA256
85c6a818e33ae8b62d15672522c0b12f2e602680f75c4414ee815a73596ad365

SHA512
5105d0f432cda4de9749e4e0dd09f9687d06ad17b7e02f98dc9d0b2ffc3d959c386302f8882c3a3f1021c39ecf88e60f5e630b929fb905eec48bead923b47e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\Raleway-ExtraBold.ttf
Filesize
159KB

MD5
27f7ef17de3691b5cdb9f1ee1ee5cc6a

SHA1
1c92715c134738f2956bf758181522243c7586dd

SHA256
118e237edf796dd76c453e912a4f445816e918bc3ff1d3941b2548c0a8fdfe29

SHA512
6d5c68056a37d989f64528c092680416c1300c95471be43ebddff7b579bcae9dfa7f402ab422406bf3a4a3df728b4af1e68e15e385b49221847f48e0bc59f228

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\Raleway-Medium.ttf
Filesize
159KB

MD5
b952c3c81ba34b54c66c748ea1e828a7

SHA1
9d35f805e98f95e72f5d0a4ced7397584d7349be

SHA256
f5a6dcd3227d1a75db47a6770e617d8077cba42c146d1d6479ae394431c7d40e

SHA512
30ddc9f9fd2916b3ac846cac60c93b5f89057a1369ffd38ccf569a6eba3dff6be10408ad7413257e794e94a46e68e67105fae28f1ce95544485edbe85842a420

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\Raleway-SemiBold.ttf
Filesize
159KB

MD5
87641f9900d717d6bfbf108b8755868e

SHA1
75f4fca0d4d80e2b9a62d3283261e933786fb8c1

SHA256
564368e49d2d7d65005649278c3e042d6954df5e5dee3874a3b548ad067db0cc

SHA512
a319660d6457efd705c291aa5445146f77e2d099ac26be3f48963b9846cb0f3cfaaee1fbd1e9acb5a7ebb74d39b541d00c76fd50932b388cee7ff54da2ef40ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\icons\close.svg
Filesize
201B

MD5
7f8d672a2849987b498734dcb90f0c51

SHA1
e53b9319bf964c15099080ac5497ee39f8bab362

SHA256
4a290648cd1cfaaf1db4909d7552ae8cb83cb0b0e36770e64d153ab07ce6e7d4

SHA512
b3ddbf719f42440238c55cee896409179b4562ffe74f607d3640f623c8264c2fd2000b085dfd9a25ffd8ba2166695dcd663efec56cdac679f9993cfb602459d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\icons\collapse.svg
Filesize
195B

MD5
ad6092934dc48be9d00331e6f21eb235

SHA1
29cd8e5478e432b386382caf6ac7b3537b108c33

SHA256
2e0eb48ef144b771903a2ee5096ac4305ef43c830d2905f46b0384a07f5f4090

SHA512
38254a977c1a74515ed6184b5ebb3b1b3125db4b713a2de69aee9dc54912a9e869fede36423548e9ebf8cfc66e6711738789ee2c33f6f3af74def779eb7e5afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\images\grain.png
Filesize
79KB

MD5
3577f702479e7f31a32a96f38a36e752

SHA1
e407b9ac4cfe3270cdd640a5018bec2178d49bb1

SHA256
cc453dfe977598a839a52037ef947388e008e5cdfe91b1f1a4e85afb5509bee2

SHA512
1a4a03931ab56c8352382414f55eb25b324e11890d51ba95597dbd867b35db45db5adcefb47d95b3763f413a66e3228e59531bdbd5ba5541469196adb5eb3d70

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\icudtl.dat
Filesize
237KB

MD5
ed8a27d4ea6697225ec1180b7b4d1455

SHA1
b594482a41843db1807315862d7d27a4c7185abc

SHA256
f1c8c8c65b15e366398593e736938aa8531181e22dd9bca0213dafcdcb5c6f79

SHA512
437ef14f2e1e463e569bfad85fe170cc0fed24182552326eacc31c588e802400ffdcdeed21e4353bf23995684d561769cc7418c60f9ead074fcb699e8289cd7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_windows.dll
Filesize
2.1MB

MD5
3484fe6f2343a0f84ed039211d910038

SHA1
55d57b78eb0bcd3f24147cb76783828974a44d9b

SHA256
a0fc8e42163c34104ea2c9504ad63bef0e292262b5fb4639f4be7213f22d21c0

SHA512
f1a2ae0bfb064be2af26a7acb31d15cee936542fbda0461d5c630013ccae7dbebdbd644e00789ba1959675233ab78b16cd45aff9def70eae68c0c5ca4ba864c2

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json
Filesize
246B

MD5
c4d9c254874726a337cee31f0edd4aa2

SHA1
5b232362a8b1c9fbe7726d6bb5e9abd7540f9be9

SHA256
ce92b927381cdcafd007aa6e363d4b5ea7dce2c42137f02ca09396f4713b09a4

SHA512
363db77b1ed1b272725afa8e7bcb912b76a0f92645aa29a0bdefe4c7ec0dae4e2cbdf358cfa84f1f5c13e20c12ad479b4379afa336b5a0756708a3e4e14ed93c

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
Filesize
160KB

MD5
2ead84d84868efb13f8ef2cc9899905a

SHA1
5b044f580c052eef4c2ab9e3f772446b2280ecde

SHA256
03377f1e71e58a58646b9443fa86c8d5e27d5457b08976b07c44a192b210f93b

SHA512
2065f2a79afac4fca286550a59cf98fd723e590591fc2272e26d9d1aa83cb21b5bf85cf2e55860d4dd7b313daac094049ab52f04e1fd6be309f17cb4bb7b2e5a

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\api-ms-win-crt-runtime-l1-1-0.dll
Filesize
15KB

MD5
f1a23c251fcbb7041496352ec9bcffbe

SHA1
be4a00642ec82465bc7b3d0cc07d4e8df72094e8

SHA256
d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198

SHA512
31f8c5cd3b6e153073e2e2edf0ca8072d0f787784f1611a57219349c1d57d6798a3adbd6942b0f16cef781634dd8691a5ec0b506df21b24cb70aee5523a03fd9

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_windows.dll
Filesize
1.4MB

MD5
ce11bf1ca387ef86f5c377b9eb621441

SHA1
8b2c6c8563c6ee7091b0e444cabd2c16a6672aeb

SHA256
d6fc9d1642c9ad88fe225fa4af73a6f34b10dda9a4a1170d389c344ac4225402

SHA512
241cc3f22037181d41934f6806d33f461f65ceb09bff1bd2ccc8d9792a387a256aa56e687b3391d6182f70a09732b7a1d94467d0a69e44e600de1e449e60f066

Download Submit
memory/1552-1098-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/1552-1097-0x0000000002400000-0x00000000031FD000-memory.dmp

Filesize
14.0MB

Download
memory/1552-1096-0x0000000002400000-0x00000000031FD000-memory.dmp

Filesize
14.0MB

Download
memory/1552-1095-0x0000000002400000-0x00000000031FD000-memory.dmp

Filesize
14.0MB

Download
memory/1552-1094-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download