Overview
overview
7Static
static
7dc22ca48da...c5.exe
windows7-x64
7dc22ca48da...c5.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...le.exe
windows7-x64
7$PLUGINSDI...le.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3MainInstaller.exe
windows7-x64
7MainInstaller.exe
windows10-2004-x64
7PingMe.exe
windows7-x64
1PingMe.exe
windows10-2004-x64
1Setup.exe
windows7-x64
7Setup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows7-x64
7$PLUGINSDI...oc.dll
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
32YourFace_Util.dll
windows7-x64
32YourFace_Util.dll
windows10-2004-x64
3AddInstall.js
windows7-x64
1AddInstall.js
windows10-2004-x64
1background.html
windows7-x64
1background.html
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-03-2024 16:55
Behavioral task
behavioral1
Sample
dc22ca48da9bee7b1a2b865df4d9a9c5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dc22ca48da9bee7b1a2b865df4d9a9c5.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/bundle.exe
Resource
win7-20240319-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/bundle.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
MainInstaller.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
MainInstaller.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
PingMe.exe
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
PingMe.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Setup.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/KillProc.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/KillProc.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
2YourFace_Util.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
2YourFace_Util.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
AddInstall.js
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
AddInstall.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
background.html
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
background.html
Resource
win10v2004-20240226-en
General
-
Target
MainInstaller.exe
-
Size
531KB
-
MD5
9ce448dcd7cf13dd950725957361bdff
-
SHA1
5831ff31825ea82d90a2989e0fc0a33b859d5f97
-
SHA256
3dbc5aff076ef9c86a90ad30e963581f7cb22f8e212aa38db29d82cf45b73f80
-
SHA512
b4a175da3677cd3380cb3789f281f2afb10aa00dc9592217062d66eb9b5e73805886b692975d7244cdd439d8d5bcd0eb5810533284ba4b13ff02a20b792bf74f
-
SSDEEP
12288:z/8Ze69hm2S17Y/bv9VXXLVS+n28L6OdBCZrrf3xSEowuj6ZQM7gMWZQkN:zihc17YpVE+PGsB03xSEowuj6ZQM71WD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3068 Setup.exe -
Loads dropped DLL 2 IoCs
pid Process 2216 MainInstaller.exe 3068 Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral13/files/0x000c00000001313f-2.dat nsis_installer_1 behavioral13/files/0x000c00000001313f-2.dat nsis_installer_2 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3068 Setup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2216 wrote to memory of 3068 2216 MainInstaller.exe 28 PID 2216 wrote to memory of 3068 2216 MainInstaller.exe 28 PID 2216 wrote to memory of 3068 2216 MainInstaller.exe 28 PID 2216 wrote to memory of 3068 2216 MainInstaller.exe 28 PID 2216 wrote to memory of 3068 2216 MainInstaller.exe 28 PID 2216 wrote to memory of 3068 2216 MainInstaller.exe 28 PID 2216 wrote to memory of 3068 2216 MainInstaller.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe /PID=0 /NOTIFY=0 /FFR=1 /FFP=12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
694B
MD544e459fe11f389e96d8d00a03942cfb2
SHA1b5140a2501ca7e998a2e93a908ceac703b4d5d67
SHA256eef938b97c56ca26c8827e8583e33aa0bc43a005b72606cad5a9a63b6a028ccc
SHA51260d3dd3189e35b6c2dee841db9e2a53af217efa2a6b7b49725b13ea3cbd48b2c6fd961b83c89087090342c70da8592b186167c7aeca49e9fae15744aafaf9f95
-
Filesize
733B
MD564af63876641894b7f608d0843f49f69
SHA1b78fadc9df0c682d670f6d77fe397268799c06e9
SHA256698f839533979c246924e04517a8d0c585e57163053eb3ec3d25e36de6dbfb3a
SHA51278b95d0432db9d8645e9c7db69e0d64115b0e1e39baf6d02ddcb591c403309539b06b35d027d68af0da663ec56eb009c7f3712e3fb1bec91fdeefd4eba8be406
-
Filesize
505KB
MD55d8d0c08384ad73216d52a2eabc064f5
SHA10fa5c77fd6b6323b926c9648679e063d1bbc8bcc
SHA25630522715240f4a05859099ac370dfb516097ab257402981c6a9ad31951f36cce
SHA51242a3003019e39622082506c7ae50d8a27e2920fdfdf15eb9a8dbf7f1dbd49a02cd0390dabd74c136ed44e9d8ba270540ce9390f31aa84c2fc9fdfcc9e912dd57
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf