Overview
overview
10Static
static
3Set-up.exe
windows7-x64
5Set-up.exe
windows10-2004-x64
10equilibrator.tar
windows7-x64
3equilibrator.tar
windows10-2004-x64
7floe.txt
windows7-x64
1floe.txt
windows10-2004-x64
1libX11-6.dll
windows7-x64
1libX11-6.dll
windows10-2004-x64
3libXau-6.dll
windows7-x64
1libXau-6.dll
windows10-2004-x64
3libXdmcp-6.dll
windows7-x64
1libXdmcp-6.dll
windows10-2004-x64
3libdl.dll
windows7-x64
1libdl.dll
windows10-2004-x64
3libgcc_s_dw2-1.dll
windows7-x64
1libgcc_s_dw2-1.dll
windows10-2004-x64
3libwinpthread-1.dll
windows7-x64
1libwinpthread-1.dll
windows10-2004-x64
3libxcb-1.dll
windows7-x64
1libxcb-1.dll
windows10-2004-x64
3libxcb-image-0.dll
windows7-x64
1libxcb-image-0.dll
windows10-2004-x64
3libxcb-shm-0.dll
windows7-x64
1libxcb-shm-0.dll
windows10-2004-x64
3libxcb-util-1.dll
windows7-x64
1libxcb-util-1.dll
windows10-2004-x64
3zlib1.dll
windows7-x64
1zlib1.dll
windows10-2004-x64
3Analysis
-
max time kernel
143s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-02-2024 18:56
Static task
static1
Behavioral task
behavioral1
Sample
Set-up.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Set-up.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
equilibrator.tar
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
equilibrator.tar
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
floe.txt
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
floe.txt
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
libX11-6.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
libX11-6.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
libXau-6.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
libXau-6.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
libXdmcp-6.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
libXdmcp-6.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
libdl.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
libdl.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
libgcc_s_dw2-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
libgcc_s_dw2-1.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
libwinpthread-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
libwinpthread-1.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
libxcb-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
libxcb-1.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
libxcb-image-0.dll
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
libxcb-image-0.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
libxcb-shm-0.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
libxcb-shm-0.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
libxcb-util-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
libxcb-util-1.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral27
Sample
zlib1.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
zlib1.dll
Resource
win10v2004-20240221-en
General
-
Target
Set-up.exe
-
Size
3.3MB
-
MD5
55076afc8f8de2df8f91fb2742bcda61
-
SHA1
c848bb01e859163b08ce4f58994b3d814dfdf700
-
SHA256
e3cb1b8edb969533e9299c4169b12df17a01d7516df943b486a785c986ceda30
-
SHA512
70bf3d76b86b28aa4209a51469a4b2161c4253313849217b5e1267cb17f6279235b9ed18cd975aa48227401b48887f594b3be149531750638091afc51a425d26
-
SSDEEP
98304:WNdaWWhvT90MSGmHUkC+UH9txcv0HGM62OQy:WNdaWWhvZ0MhmHUkxUH9tx1HA
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Set-up.exedescription pid process target process PID 2180 set thread context of 2032 2180 Set-up.exe netsh.exe -
Loads dropped DLL 7 IoCs
Processes:
netsh.exefm.exeWerFault.exepid process 2032 netsh.exe 1628 fm.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2280 1628 WerFault.exe fm.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Set-up.exenetsh.exepid process 2180 Set-up.exe 2180 Set-up.exe 2032 netsh.exe 2032 netsh.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Set-up.exenetsh.exepid process 2180 Set-up.exe 2032 netsh.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Set-up.exenetsh.exefm.exedescription pid process target process PID 2180 wrote to memory of 2032 2180 Set-up.exe netsh.exe PID 2180 wrote to memory of 2032 2180 Set-up.exe netsh.exe PID 2180 wrote to memory of 2032 2180 Set-up.exe netsh.exe PID 2180 wrote to memory of 2032 2180 Set-up.exe netsh.exe PID 2180 wrote to memory of 2032 2180 Set-up.exe netsh.exe PID 2032 wrote to memory of 1628 2032 netsh.exe fm.exe PID 2032 wrote to memory of 1628 2032 netsh.exe fm.exe PID 2032 wrote to memory of 1628 2032 netsh.exe fm.exe PID 2032 wrote to memory of 1628 2032 netsh.exe fm.exe PID 2032 wrote to memory of 1628 2032 netsh.exe fm.exe PID 2032 wrote to memory of 1628 2032 netsh.exe fm.exe PID 2032 wrote to memory of 1628 2032 netsh.exe fm.exe PID 2032 wrote to memory of 1628 2032 netsh.exe fm.exe PID 1628 wrote to memory of 2280 1628 fm.exe WerFault.exe PID 1628 wrote to memory of 2280 1628 fm.exe WerFault.exe PID 1628 wrote to memory of 2280 1628 fm.exe WerFault.exe PID 1628 wrote to memory of 2280 1628 fm.exe WerFault.exe PID 2032 wrote to memory of 1628 2032 netsh.exe fm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\fm.exeC:\Users\Admin\AppData\Local\Temp\fm.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 2124⤵
- Loads dropped DLL
- Program crash
PID:2280
-
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2520
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1001KB
MD5d57a60273dd3538267f15abee940f74b
SHA1c9e265b24a46fce2922f4700b513700618198ee9
SHA256edc9b17f6b55bc0e76ca07d73a0f63a5ccb97534c90d59b06d0e3271779fe61f
SHA512e4dac81f73bea9b8ceb779a118cdd0138f01160cef2849ee60b5c6ee61430ee65a7d4ec8f576c5a300feab3f9ab2e9d1bd4e80bf984cd6303fc013ed1a9fac8a
-
Filesize
994KB
MD5de0ea31558536ca7e3164c3cd4578bf5
SHA15cc890c3ade653bb1ed1e53dabb0410602ee52df
SHA2566e599490e164505af796569dce30e18218b179b2b791fe69764892b3ed3e7478
SHA512c47299cd5f3b4961f423c2ca1fef5a33eb4b0f63dc232af70ef9da39f6f82270406061dd543461de7e47abd1244e26d6190de6035120211b27d4c23f97a25aba