1eb4db65ad70c914b2f5690d3ea5a3710578a60209780d228389ca0c305b0057

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VideoGetInstaller_trial.exe
Size

3.5MB
MD5

e25e5afec33c8583c8216ccffead38fd
SHA1

56486110e3d0f3ca9e3139c5e4389e1bce255556
SHA256

be08b756f07058e58ed20b1686bc6498db91983c3b7ff42136eef0bf2267e858
SHA512

182425348809b32da8e0b244cf164c029cac18ae7d128fd7a2cc8d9e36b342373be2bde6a94a4fe9f022fc680211e706841f9364b86c9e79c78800fbcd3fdac6
SSDEEP

49152:YhC3stkg5ANWhRZvnKxR75a1MqMFEDRojzdbp4bXiUi2NZ/UhpJM0z6bphvxkGIQ:xstF/KT5POFolLDMMevxkGIp4/tMU

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3516	VideoGetInstaller_trial.exe
3516	VideoGetInstaller_trial.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\VideoGetInstaller_trial.exe
"C:\Users\Admin\AppData\Local\Temp\VideoGetInstaller_trial.exe"
1⤵
- Loads dropped DLL
PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsk39ED.tmp\InstallOptions.dll

Filesize
12KB

MD5
444e1109d960c307df0ca2b33a24731b

SHA1
55e3b57d06128911ed4af44858d199d9b1945edc

SHA256
b3ba181120cd5b57e2cd5435bbd64c3257f7525ade359f89554e93f466692125

SHA512
9efdb45ee0eae73c24d3f01ff799160090f2b1f0f28ee8da3af52992fec220bf905070ce5a6cc1b5657642440ad29c22bc6889cd3ee1f674a908a935dcf4c2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk39ED.tmp\LangDLL.dll

Filesize
5KB

MD5
16cd5a02b2478d68b887724be8e08c68

SHA1
aaefd783c0c4dc98b9d34de36c1e0bf83b6ab312

SHA256
dfd8fd2e7edcdcc97558d11d6ef1fcb676610a9211c9570c118cd40905e5b165

SHA512
b52ba5f9a8e22fe49b973bbf3709147948e1318b833dee8e67a7950796c39685dc21925c0e0da0f45d8b74f904f52ec877615522a052677a0c7537ea8a8bae23

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk39ED.tmp\ioSpecial.ini

Filesize
606B

MD5
a405e50e7e269e0ca0b37c02c45f6aa6

SHA1
13f9aed169c75a092e9edfe2dfe007893bde9485

SHA256
89aebd260edd1343e8684b5ff326294d30407d1ddf8e40d8c5c2850193c37c3f

SHA512
074c163d17958a01ad01c0a8ac30f4a26926328f124486370d94951843e09f3b9d3571dd2a6c9634973a051d4777951a92381a8b65e6f671111f6924b63ec7fb

Download Submit