4c51547745fd5b7c107e5b89cbd6be9ea4d43195fb4a1011987c8a33b7158251

Analysis

max time kernel
121s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NoteSetup_3.1.4.3735.exe
Size 294.3MB
Sample240302-db1qeahe48
SHA256 c814c947ae902f41b9ae83623def1b8c84f4c96f574919603c1feff73071ea49
MD5 a63fa4b5bd84f0cba82e8540d5f5f386
SHA1 37d0498052f4c025d844d89d18621675ee389d52
SHA512 ff78c8203a2f408be2f79dbb56f49363f0150b6e900b74b2dd5c8e83ea1516ef9e9dd6863c1f2da0a553db5821a4a6c4c2849a89c7c7cb7600646e2c70dad868
SSDEEP 6291456:ann/mqlmH9PbvQBzLeRSKxOtvc/4KPv1vTr+OVV1C+OVVCaN5:mnjYqsEvc/4KPNvVP1UPCW
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
4736	NoteSetup_3.1.4.3735.exe
4736	NoteSetup_3.1.4.3735.exe
4736	NoteSetup_3.1.4.3735.exe
4736	NoteSetup_3.1.4.3735.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\NoteSetup_3.1.4.3735.exe
"C:\Users\Admin\AppData\Local\Temp\NoteSetup_3.1.4.3735.exe"
1⤵
- Loads dropped DLL
PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nslBAB6.tmp\LangDLL.dll
Size 5KB
SHA256 d28606056c23e9f058fc216639b83295be91fc5ad2ab0f5256ef7d6d2ecc6279
MD5 004e166a609afadb6a01214b61e20d03
SHA1 9e67f9d9558307fdff22006be103d15903252187
SHA512 5ecadec87b7a364ddb9bb8ef1bfd01ee69a838fe65b4b999afeb403b5be6061f324e4ba1673df16814326252706a9ef85cb2a5ed6321b934a475939dd9268647
SSDEEP 48:am1CTTpeApYx1lxaK1vPuEXWJZGWcBWMGSft2J18m1ofYZVS:kpGhxaGvPzXWJcWcBx0umJV
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nslBAB6.tmp\System.dll
Size 11KB
SHA256 72253837028abed272e5d50a3a6771933e9dd1aad73e90b8db4538aa9c786cbf
MD5 7df8fb4196186f28cb308f9952d7ef64
SHA1 f20a7259ad233ac3795b6e6537de658209a8fd40
SHA512 3f373d69664ce015ceab16c12ba4c806c3489b89ae9db282551ec2452acd2ced1d70ddd4de0ef8c56d62a715624c9d2ceddc968adf07e905f2e4c81c2850ae4b
SSDEEP 192:jEvCcZ5+twSkY1YLKs4C/nWRfVMd8kQdOPEbpNZ8rQ6prY8:iCAGCYNs4C/nWxVg8kTM1yTFY8
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nslBAB6.tmp\nsDialogs.dll
Size 9KB
SHA256 6da0ec15a4d3bbcfdd82d36838abcf8d57515d06049290801e5d71b4fd021dab
MD5 3ff6d8bfd6784eb4325102d9f76a0fe1
SHA1 1eedf67a5f3ea636bcb621402bb679d3e08c0414
SHA512 dcc6c3ad393503c6527528d4fccc8b4faf25c6ff50a08c29247ab144f444d31590e3f7a581b2c955b0a109b552f0b7e3b4ae1849228d31a220d46eb5e1e2d26a
SSDEEP 96:pwsl+ukKv9ZmksljxV9RtSA2RV8YWpg5J4U3mZjwdE6o8zfFeZtrmfVEBbYezMJn:7l+UvsjtSA4NigAU3mtvkFeCNyxzMzV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads