c114ff90e7cb93cadea5d4af69624c5c17b7beaafe0e0285f41371fe5c68b76d

Analysis

max time kernel
146s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 14:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

unlocker-setup.exe
Size

2.3MB
MD5

5aff327b388e7dbd63509f44c0e23d3a
SHA1

9bf4da1bf90a69413cdd003f65ad4d2a91396e67
SHA256

c114ff90e7cb93cadea5d4af69624c5c17b7beaafe0e0285f41371fe5c68b76d
SHA512

4195d17a2ece882b10c9ba5376ba9a6873d421b3708a6b40281e0a2f164be06bba9b23ae5d187b910109b8871d38fbae4e03278af5ceb59f6d2d071574d51b17
SSDEEP

49152:jIPYz2KQMb4jfbDalv1AZkMV8XzhjBT3uBZAKxhqPl/pspgG9hmY0hW3hUyn:uoXQMbayUkogdjAYNhqhmYaWJn

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2888	unlocker-setup.tmp

Loads dropped DLL 4 IoCs

pid	Process
2808	unlocker-setup.exe
2888	unlocker-setup.tmp
2888	unlocker-setup.tmp
2888	unlocker-setup.tmp

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2888	unlocker-setup.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	unlocker-setup.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2888	2808	unlocker-setup.exe	31
PID 2808 wrote to memory of 2888	2808	unlocker-setup.exe	31
PID 2808 wrote to memory of 2888	2808	unlocker-setup.exe	31
PID 2808 wrote to memory of 2888	2808	unlocker-setup.exe	31
PID 2808 wrote to memory of 2888	2808	unlocker-setup.exe	31
PID 2808 wrote to memory of 2888	2808	unlocker-setup.exe	31
PID 2808 wrote to memory of 2888	2808	unlocker-setup.exe	31

C:\Users\Admin\AppData\Local\Temp\unlocker-setup.exe
"C:\Users\Admin\AppData\Local\Temp\unlocker-setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\is-6R51I.tmp\unlocker-setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6R51I.tmp\unlocker-setup.tmp" /SL5="$401D8,1908525,139264,C:\Users\Admin\AppData\Local\Temp\unlocker-setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-6R51I.tmp\unlocker-setup.tmp

Filesize
1.1MB

MD5
e539e086641a28dce788d5bccdb3b45a

SHA1
408b3578f4be53509531f5a99801f96640835235

SHA256
a62aca7bd97a651582b5ee0a56935ad9ffe57032d3a01c2922d6cef3b6a93cd8

SHA512
009fe324a0d937083c3ab5ed0d1110a9ba3fb2bbdfe919d23d6e32000e1e77f3624935dc92605fbc488c0f5d99005d4e1965cfeba1800b37d9971bc4c3e2cf5d

Download Submit
\Users\Admin\AppData\Local\Temp\is-V4F3O.tmp\IObitUnlocker.dll

Filesize
71KB

MD5
e1a4327af3cd8ca866996f472f0ff93a

SHA1
cfea8426ef8fab4136055401152821a19f908d45

SHA256
5f0bc7d75f32981e0e704c2217ed423c9a355f19515a1603103cc55cf9d3b901

SHA512
745f1ec495869d2fa2722ecadcaa27ec1f005742c69110802e9e1d7600d680d077e9762a400799e38003a4671a2590ecf1c480c2e7586039ebcce6ed36662280

Download Submit
\Users\Admin\AppData\Local\Temp\is-V4F3O.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/2808-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2808-26-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2888-11-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2888-27-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/2888-30-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download