965616976ed28bffd24f8316ba6bad5d6008dc511c757643f038bc6c57c37e2b

Analysis

max time kernel
141s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

1.5MB
MD5

0878e6d9ef048ec2fa1242f41efcbd23
SHA1

df2eec2f03a400d6af63083ff87554ccbb4b7c1c
SHA256

3b85494d6061fd5776aaebe6ed3d9279db2e54b32d2732cf7d0142fe625f5668
SHA512

55197a346c3a0d17fb69425b3f263a7f20c21a00868f509a79170b7ff20d3ad7625b4ee79a8af8f0f3182c34034b008d50a07a2b98566720a72f318f0e531611
SSDEEP

24576:2dxGJlyasqigby7xut7UgXxGzsHtRxGDRGCs6MaPJ+M6+dhp5l9TfgSodpkLlDu9:iwyasqtYxC4gBGzqGDse54M6u5nmrkLE

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
868	setup.exe
868	setup.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/868-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/868-6-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/868-83-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Loads dropped DLL
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy351B.tmp\InstallOptions.dll

Filesize
12KB

MD5
43ba71f370a45aebcde86d76b83b208c

SHA1
1f14e3c253a5b7255b617084b45e51ef9d6717e4

SHA256
6d0a19614efb523f78477429df04b71459ee69b3d16231798dcfa539b3d2a64c

SHA512
36aaf1ccb7c1085ba9fbacbad6c1505c9e389be5e9bd52ee7046b48302b8239d6e34dfeeb32a2708c4fb7d5a85c1d202fbdabcdd6a2cced0099249640443b551

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy351B.tmp\LangDLL.dll

Filesize
5KB

MD5
4551aee5b604f7a4fdeb95dc1364adaa

SHA1
e6aa9b8072351b098a6b777616f4e949051dfc01

SHA256
e90123bb975b4d9a79efcf9e84f849d9de1c9a564f62197092e7f7ad718578d3

SHA512
0be8829d33af093b9bc6b5d6ee1506656b9fe513f518e1922804e93b59e3c5832f8ae78fa79fb095da5630765949af812cd7d88e2b42daed0150e5798abc9445

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy351B.tmp\ioSpecial.ini

Filesize
692B

MD5
075d41802cd3729de80db49fd2fc2a41

SHA1
2e7d279bf85a9ad159027b0483b2cc1582706f22

SHA256
f4b023d56bb81f7f8fb9439636bf3c0c97f80f38df58d0bfd21b1ba283c4a055

SHA512
7ae0c1df75a137b5cadf1cf64b3ac7ea4603a3a857186dfb8ce6db3a34fbbfd88f7d9bb2c5eff3da84b886fa155a4b4e53d875f754e2b063da3aeec9cd9f1020

Download Submit
memory/868-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/868-6-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/868-83-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download