b4873ade58e22893042b36bdd7c1a3316364b6ddf52952117b0975f5237cb9cd

Analysis

max time kernel
30s
max time network
18s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Set-up.exe
Size 3.3MB
Sample240224-qephrsdc7v
SHA256 e3cb1b8edb969533e9299c4169b12df17a01d7516df943b486a785c986ceda30
MD5 55076afc8f8de2df8f91fb2742bcda61
SHA1 c848bb01e859163b08ce4f58994b3d814dfdf700
SHA512 70bf3d76b86b28aa4209a51469a4b2161c4253313849217b5e1267cb17f6279235b9ed18cd975aa48227401b48887f594b3be149531750638091afc51a425d26
SSDEEP 98304:WNdaWWhvT90MSGmHUkC+UH9txcv0HGM62OQy:WNdaWWhvZ0MhmHUkxUH9tx1HA
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 2632	2860	Set-up.exe	28

Loads dropped DLL 2 IoCs

pid	Process
2632	netsh.exe
2564	fm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2860	Set-up.exe
2860	Set-up.exe
2632	netsh.exe
2632	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2860	Set-up.exe
2632	netsh.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2632	2860	Set-up.exe	28
PID 2860 wrote to memory of 2632	2860	Set-up.exe	28
PID 2860 wrote to memory of 2632	2860	Set-up.exe	28
PID 2860 wrote to memory of 2632	2860	Set-up.exe	28
PID 2860 wrote to memory of 2632	2860	Set-up.exe	28
PID 2632 wrote to memory of 2564	2632	netsh.exe	30
PID 2632 wrote to memory of 2564	2632	netsh.exe	30
PID 2632 wrote to memory of 2564	2632	netsh.exe	30
PID 2632 wrote to memory of 2564	2632	netsh.exe	30
PID 2632 wrote to memory of 2564	2632	netsh.exe	30
PID 2632 wrote to memory of 2564	2632	netsh.exe	30
PID 2632 wrote to memory of 2564	2632	netsh.exe	30
PID 2632 wrote to memory of 2564	2632	netsh.exe	30

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Users\Admin\AppData\Local\Temp\fm.exe
    C:\Users\Admin\AppData\Local\Temp\fm.exe
    3⤵
    - Loads dropped DLL
    PID:2564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

a4322c5a

Path C:\Users\Admin\AppData\Local\Temp\a4322c5a
Size 1.9MB
SHA256 8d741e4d6b53fcd2b682756cc11dd7a98424c945d93e201d69025f2422e04417
MD5 09a02482e76630c3865382b77c258426
SHA1 3de26992716aa73d85c344cabba947b98bec293c
SHA512 b39cea9d39e203e947e8dae38c922776dbda60e66b36c34ccbce31c6d44d80871f0488adb041c8784ec3daba2a3960ac1c3b79158165f556ff99265cf8b7e935
SSDEEP 49152:nwqHkAr+R+T0Ppu+0n6mfsPvKgOc3812NBEgYy:n/HkUCpI2EmBwy
MD5 SHA1 SHA512 SSDEEP

Submit Download

fm.exe

Path \Users\Admin\AppData\Local\Temp\fm.exe
Size 994KB
SHA256 6e599490e164505af796569dce30e18218b179b2b791fe69764892b3ed3e7478
MD5 de0ea31558536ca7e3164c3cd4578bf5
SHA1 5cc890c3ade653bb1ed1e53dabb0410602ee52df
SHA512 c47299cd5f3b4961f423c2ca1fef5a33eb4b0f63dc232af70ef9da39f6f82270406061dd543461de7e47abd1244e26d6190de6035120211b27d4c23f97a25aba
SSDEEP 24576:eZwu3kI1OqRsSLJG+tr4mr08m5GV1eFSxdRMfJs:w/3DUqRLJGLQwGVQSxdRMfJs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2564-43-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2564-42-0x0000000077620000-0x00000000777C9000-memory.dmp

Download

memory/2632-32-0x0000000077620000-0x00000000777C9000-memory.dmp

Download

memory/2632-40-0x0000000074B80000-0x0000000074CF4000-memory.dmp

Download

memory/2632-20-0x0000000074B80000-0x0000000074CF4000-memory.dmp

Download

memory/2632-34-0x0000000074B80000-0x0000000074CF4000-memory.dmp

Download

memory/2632-35-0x0000000074B80000-0x0000000074CF4000-memory.dmp

Download

memory/2860-18-0x0000000000400000-0x0000000000787000-memory.dmp

Download

memory/2860-26-0x000000006DC50000-0x000000006DC5D000-memory.dmp

Download

memory/2860-31-0x000000006DAB0000-0x000000006DACE000-memory.dmp

Download

memory/2860-30-0x000000006DBD0000-0x000000006DBDE000-memory.dmp

Download

memory/2860-29-0x000000006DBE0000-0x000000006DBED000-memory.dmp

Download

memory/2860-28-0x000000006DBF0000-0x000000006DBFE000-memory.dmp

Download

memory/2860-27-0x000000006DBC0000-0x000000006DBCF000-memory.dmp

Download

memory/2860-24-0x000000006C370000-0x000000006C4B3000-memory.dmp

Download

memory/2860-25-0x000000006DC20000-0x000000006DC48000-memory.dmp

Download

memory/2860-21-0x000000006E010000-0x000000006E02C000-memory.dmp

Download

memory/2860-22-0x000000006DFD0000-0x000000006DFF3000-memory.dmp

Download

memory/2860-23-0x000000006DDC0000-0x000000006DDE0000-memory.dmp

Download

memory/2860-0-0x0000000074B80000-0x0000000074CF4000-memory.dmp

Download

memory/2860-16-0x0000000074B80000-0x0000000074CF4000-memory.dmp

Download

memory/2860-15-0x0000000074B80000-0x0000000074CF4000-memory.dmp

Download

memory/2860-1-0x0000000077620000-0x00000000777C9000-memory.dmp

Download