13c784cca18a94ac2b60059e30f75dae749640feea1c7738b95c3cc93b529c03

Analysis

max time kernel
150s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16/04/2024, 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OBS_Spout2_Plugin_Install_v1.8.exe
Size

355KB
MD5

22242f55cdab3701213e85bac7585b52
SHA1

a9264fdc715defee089f7aa9415a13e0f033afb3
SHA256

13c784cca18a94ac2b60059e30f75dae749640feea1c7738b95c3cc93b529c03
SHA512

49b80d459a9521b015ebeb21aca198a00dd94b35b70e6ec0f41ab09d29256126ce48b0032d2e54a8da2bbd1b0b03bfff691a243175668f7592be1f8f5253e7ca
SSDEEP

6144:3T4DtBqikdKDYlX6n5ouMzzMKMJ6+ZIhz7SrzxPjqJHaufg/z2KGimQVWJl:3T+qikqoX25o1Pu6+sz7SPl6auf6zvmN

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1292	OBS_Spout2_Plugin_Install_v1.8.exe
1292	OBS_Spout2_Plugin_Install_v1.8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\OBS_Spout2_Plugin_Install_v1.8.exe
"C:\Users\Admin\AppData\Local\Temp\OBS_Spout2_Plugin_Install_v1.8.exe"
1⤵
- Loads dropped DLL
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsc98F5.tmp\InstallOptions.dll

Filesize
15KB

MD5
0a9fb96a7579b685ec36b17fc354e6a3

SHA1
355754104dd47d5fcf8918dee0dc2e2ee53390a6

SHA256
b34fb342f21d690aac024b6f48a597e78d15791ef480ac55159cd585d0f64af7

SHA512
67870206fa7f1e7df45c8c1bc2f51fb430f0a048a2bdb55a4a41525388ca3b50203784537f139169705a03db4bb13b591162a79a5d2df81a4d11fd849615c86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc98F5.tmp\ioSpecial.ini

Filesize
1KB

MD5
1d352c90f7ad8a78e209d66a4caeb1f7

SHA1
912f0ea4a3f7a583500e317c3a1c6c0e63d813b4

SHA256
693b777ef4860810f4e231f9ff979d8b3dfdd89cfc44a625155e30a0a2c8a25e

SHA512
390c6de68d97e0391d614b8a168dbe98b7ba10f9140f73dedc9a1ddeed2309a5dd6ee0de3f062f243fabc6b9bd8ab41fafcf6d87b1b176c8b969056eede9c1c8

Download Submit