Analysis
-
max time kernel
137s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 20:14
Behavioral task
behavioral1
Sample
JangaFX EmberGen Enterprise v1.0.4 WIN/Read Me.txt
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
JangaFX EmberGen Enterprise v1.0.4 WIN/Read Me.txt
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
JangaFX EmberGen Enterprise v1.0.4 WIN/crack/EmberGen.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
JangaFX EmberGen Enterprise v1.0.4 WIN/crack/EmberGen.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
out.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
out.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
JangaFX EmberGen Enterprise v1.0.4 WIN/embergen_1_0_4_installer.exe
Resource
win7-20240221-en
General
-
Target
JangaFX EmberGen Enterprise v1.0.4 WIN/embergen_1_0_4_installer.exe
-
Size
57.2MB
-
MD5
43c20c7a3a57962ba3aa44b3bd00bace
-
SHA1
7f05507330c51b165f0e6a7403b777d3e6ef4e6a
-
SHA256
6a0d23beb7ac16c0b106fb9e2e8bf11eea02f088a905f9809390c08c4a949cf4
-
SHA512
4835bbfb2ef32e1360bfd29baa36bce8201b4f953d36c917f7d755e5815e8a1d7890948d6ab1750208ef7206904c6061d720883315e4d14e4de8893963a5e348
-
SSDEEP
1572864:gbvQ1s9XcrVzPPba3msz0ISQEH7HCDNE610hHSS4i4o18N:gDQdVDDIOeEbiDb1MSS47N
Malware Config
Signatures
-
resource yara_rule behavioral8/files/0x000600000002312d-181.dat upx behavioral8/files/0x000600000002312d-270.dat upx behavioral8/files/0x000600000002312d-271.dat upx behavioral8/memory/2068-276-0x00007FF6446A0000-0x00007FF646EF8000-memory.dmp upx behavioral8/memory/2068-281-0x00007FF6446A0000-0x00007FF646EF8000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\JangaFX\EmberGen\is-D0LKM.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-NHKD4.tmp embergen_1_0_4_installer.tmp File opened for modification C:\Program Files\JangaFX\EmberGen\license_manager.exe embergen_1_0_4_installer.tmp File opened for modification C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-QMA3I.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-AM2AT.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\is-AM5QB.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-QKGUN.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-UO0HP.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-SD0DS.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\is-QDVMR.tmp embergen_1_0_4_installer.tmp File opened for modification C:\Program Files\JangaFX\EmberGen\TurboActivate.dll embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-A8OJP.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-FNMSN.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-1USCR.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-2O8SO.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-Q8BID.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-QQKET.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-NCPOF.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-FHQHJ.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-SUSQF.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\is-Q1LMM.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\meshes\is-BBSIF.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\templates\is-TS4MD.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-25F48.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-UUQMH.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-E8CF3.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-885SL.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-J96K7.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-5CELF.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\unins000.dat embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\is-KKAQS.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-LF08Q.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-57P15.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-88MRP.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-0CIVQ.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-SK6P3.tmp embergen_1_0_4_installer.tmp File opened for modification C:\Program Files\JangaFX\EmberGen\unins000.dat embergen_1_0_4_installer.tmp File opened for modification C:\Program Files\JangaFX\EmberGen\TurboFloat.dll embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-2S73F.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-8SH9H.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-K3IO7.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-9MUU4.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-S8L49.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-D63GK.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-H96VE.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\meshes\is-539B3.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\templates\is-AV9K3.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-IJOJJ.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-MVLC4.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-63Q8H.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-423UC.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\templates\is-VT2I9.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\is-GP6GE.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\is-BLFFR.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-C7BAV.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-DN87V.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-4S53F.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-96CQO.tmp embergen_1_0_4_installer.tmp File opened for modification C:\Program Files\JangaFX\EmberGen\EmberGen.exe embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-6LMQU.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-2J7BC.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-OCO1S.tmp embergen_1_0_4_installer.tmp File created C:\Program Files\JangaFX\EmberGen\presets_1_0_0\is-Q2NTA.tmp embergen_1_0_4_installer.tmp -
Executes dropped EXE 4 IoCs
pid Process 5008 embergen_1_0_4_installer.tmp 4684 VC_redist.x64.exe 2276 VC_redist.x64.exe 2068 EmberGen.exe -
Loads dropped DLL 3 IoCs
pid Process 2276 VC_redist.x64.exe 2068 EmberGen.exe 2068 EmberGen.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5008 embergen_1_0_4_installer.tmp 5008 embergen_1_0_4_installer.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5008 embergen_1_0_4_installer.tmp -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2512 wrote to memory of 5008 2512 embergen_1_0_4_installer.exe 86 PID 2512 wrote to memory of 5008 2512 embergen_1_0_4_installer.exe 86 PID 2512 wrote to memory of 5008 2512 embergen_1_0_4_installer.exe 86 PID 5008 wrote to memory of 4684 5008 embergen_1_0_4_installer.tmp 92 PID 5008 wrote to memory of 4684 5008 embergen_1_0_4_installer.tmp 92 PID 5008 wrote to memory of 4684 5008 embergen_1_0_4_installer.tmp 92 PID 4684 wrote to memory of 2276 4684 VC_redist.x64.exe 94 PID 4684 wrote to memory of 2276 4684 VC_redist.x64.exe 94 PID 4684 wrote to memory of 2276 4684 VC_redist.x64.exe 94 PID 5008 wrote to memory of 2068 5008 embergen_1_0_4_installer.tmp 95 PID 5008 wrote to memory of 2068 5008 embergen_1_0_4_installer.tmp 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\JangaFX EmberGen Enterprise v1.0.4 WIN\embergen_1_0_4_installer.exe"C:\Users\Admin\AppData\Local\Temp\JangaFX EmberGen Enterprise v1.0.4 WIN\embergen_1_0_4_installer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\is-57CBI.tmp\embergen_1_0_4_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-57CBI.tmp\embergen_1_0_4_installer.tmp" /SL5="$80050,59153228,832512,C:\Users\Admin\AppData\Local\Temp\JangaFX EmberGen Enterprise v1.0.4 WIN\embergen_1_0_4_installer.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe"C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe" /install /quiet /norestart3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\Temp\{4BC4C7E2-6057-4E70-988A-FF142A91B23D}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{4BC4C7E2-6057-4E70-988A-FF142A91B23D}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe" -burn.filehandle.attached=648 -burn.filehandle.self=656 /install /quiet /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276
-
-
-
C:\Program Files\JangaFX\EmberGen\EmberGen.exe"C:\Program Files\JangaFX\EmberGen\EmberGen.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
MD54be377c5bb118b96fba2e450e0a9267b
SHA1e1851fcbb81d2aef36cdd6a5a3c07354c8dd85e5
SHA256208b838755083599b358550988c841f31c6aa835d030a071b6a50cc9e463f05f
SHA51242fb53dd69c1587c132adf98136b95fcd583038b753c4a46aaf309f0173d9fcd41a84bfc699e201238dbb586eaaadba16d15739a5ca1575efb13f8c383089a6f
-
Filesize
256KB
MD5d03ad72b685952f2a93d15009344761e
SHA1129e387d997b8974f66987cd3e1d71d14c332b5d
SHA2566d0a9886c8cfe12c83498a609c86acf8af0b68f0264edfe5cb8f49e4e1b91777
SHA512201037b914ee9d1b56e55d58e13d83fc758620003c2aee45f618e9299ebfbe1333fcaeee0e6162ee5d5044ed7480b690eb5a8d18177aad94353da210efa506f3
-
Filesize
448KB
MD56079968d9202a78a86d83fe7423f8fdf
SHA10ec307b0ef5f10b6dd2fdc23e87b808ee590fb02
SHA2561ac719ec362633463f5dbf450f95b84aa34c8be7971f88825d8a1fda684d87c9
SHA5126ee9a286afa69e976bd2a0bdbbc584fde8bbbd4cb450942575c44539f641fa4343de381029c56b79d8b2c4975dd143d541eafb77f0e802b2e05921d1cebb960e
-
Filesize
1.3MB
MD55bbec33f549e9e44389be11ceb3c3f02
SHA13aeb71f10f5fa8b5df59358e0c6e3b7a21a23217
SHA256f53487d184b268f5ddcecff98c2f62e5141ec0030b54a65f02cc4e7057d5c7ad
SHA51291df575a850276d9eb4aa19ff32b74e4947a5b5836ee874a95a793603aef3330e7b73e1cca43cfcc432558800f46749e9bb51cb9504847c98e85fdcb81bbe571
-
Filesize
1.2MB
MD5e63679298cbf7273e4ac8f4bf720f68a
SHA1b4ef94f680090e17b46ed1b4f1d3ebc4ee9bf7ea
SHA2561475605b46351616689811a3fbcbbaae1bb40b62612986edfbae5e05df096963
SHA512892e6256d4eaa1e6d31d06b33729def3eb8abfccf2b345dc717ff540a27987956a67bcbf7ad159879ee516beeb2b532676cc220c32f2f36d4cdff37ab470770f
-
Filesize
4.9MB
MD56b09e111b6a9c7725cd48e6485b9d823
SHA1d1ffd368ef9afe60f4102826840aba1e68cabe32
SHA2567c8996c90a3b310ae8d59f85be3eaf9e4c729422af5a8262f102989a5bc7313b
SHA5122d8e132485a80b64f6e0dfdef6af2b1da6adadd44ee22b3b7ae348bad4232f94987e08be70d78945c922e78c089bf90344f42fec307f92c2b69377d1186607ff
-
Filesize
4.6MB
MD57677277c01c387582fb317f8bb7ed61b
SHA1ae1e81cb079c83aeca6ea74913a71674d4d64190
SHA2563c8a397865058c39c3e92afc33181c3ecc11476d6bf7ed1de540487824019b3b
SHA5126224ce2492dea48105482987eb0b983e147746a8b803061e08e215f01348e2bb7f60b97650a0bb1edb26d052af632735979d2f7f6f4f8176246688fbf4fba9a1
-
Filesize
3.1MB
MD533e017fa55cece71daf2f1b7a289b380
SHA18a834d925e74e9c89f93e9b46c01791e84c2d966
SHA256d478c7730c76bdb3250acd7f0c7ca5895df7710c3283e2507450ee72bf15f2c7
SHA512a0457630d8735e07e1ab9832ed71379ccb2630f8ff17738ca706331abf81d0832925e5f14fd555a256268dc089ff81434bbb6afe305039999ef9e0316954f05f
-
Filesize
384KB
MD557cdadede3379a93633287fd16376b6c
SHA1fd39252fb552d7dc0967e386eb9324e00f4b242b
SHA256ac9a98826f75cfdd1fddeb4b5d7c67accb1a1cc2250fa47b664bc7abd87be9d1
SHA512cb9cef89e24e7f552055aea3bbf4a41198e579bd99a61cbed0392377e044ebbde098a5a05c4453157721b3293a4fa97b89e1087961045913892c33cebe626057
-
Filesize
633KB
MD57f28c88875700454d8fb733341658edd
SHA1434159872b168112b86e91cf84f4d9d545ab0410
SHA25692d6a54089399fab9f00f25ccf568bdc2f4838aefbf37d51bc1ac94ed41508b9
SHA5127b0d332ef78506e116ad620eb34424d7ca168822f768c30fe54a55168075e88d9fb40f1c4eb02498c3379843f50ac79bcc3d42a77b82d6157bfbd3fc4bd462fb
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2