Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
27-04-2024 23:01
General
-
Target
ArmDotSetup_2023.12.0.0_1.exe
-
Size
4.8MB
-
MD5
e21d4b09e78cc32858917210629d1d93
-
SHA1
590a07a7a7a3eebd7d5d49cb34788b25bbcd2018
-
SHA256
da109f5ec326e3298fa0eea86201166aec6432cdc64ac94c200d0145b810f55b
-
SHA512
4fac88d6ac76bebc9419d16696599a3edf95f222d8a57f8e43b2d1633b827bc44923fc7aa14ec6b69a533dff1ca8b9112bb3328252047818d9e8bfc37e94cc5d
-
SSDEEP
98304:Ym8T2zeeTtdOzFbl8ZQbJIGmYef9ikWAQ0f7WbqErX0:AazXbZQbKv/9SAHTCqEQ
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 41 IoCs
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 10 IoCs
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ArmDotSetup_2023.12.0.0_1.exe"C:\Users\Admin\AppData\Local\Temp\ArmDotSetup_2023.12.0.0_1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NNQ7U.tmp\ArmDotSetup_2023.12.0.0_1.tmp"C:\Users\Admin\AppData\Local\Temp\is-NNQ7U.tmp\ArmDotSetup_2023.12.0.0_1.tmp" /SL5="$6004E,4617382,121344,C:\Users\Admin\AppData\Local\Temp\ArmDotSetup_2023.12.0.0_1.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ArmDot\ArmDot.exe"C:\Program Files (x86)\ArmDot\ArmDot.exe"3⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD532baf8bf82e643bab2ec0367de91d791
SHA1ea1d7fb5d3cf2c0ba8b4a318dd32a71d640beb4b
SHA2568c1fdc6e6c5f37de3b99b3aa3a146433199e494a1a170ccd06552db105a17fcd
SHA512a59e463d9876fb146f5d3655d5faee05aeee36050dbd5dbc63d9d6b8fe6606976b1379b777cce0d29fa58ff61b8b5e288f41978a214fd0e7f4ea547e219d5aec
-
Filesize
4.4MB
MD5ab7a92faefc2d0d4414bbbd5834ae253
SHA1acf33224b23cf1ebc4af822796e069de38fc81f1
SHA256dcdbbc96f989f63f708b98613ebca1fc649ea8b86c79d2721012c4ca56c211b9
SHA5129866d013392317de51e433aeea2dd87cf92e1b1fc93ab1fc7504ebbc6b905e61000f213d72f33af2117b65699be8e1a0e59f92e273975001629b421efd0449ae
-
Filesize
30KB
MD5a0d14dd586a868ecc9f6ed766589bf5c
SHA18962415374eb1ab85d343f9f9232bd040aa62b86
SHA256ff1648320770e5bbd8e3b643ca0f8704af2024318760898a6bac5c0b99e4ad12
SHA51218037f3a9cb9c68b57c6f0179541aa0c457d8a4f366ff45b5dd30258607f3630dc65a14d4e74c2b401f319500a11e4e6f57b3ecc412cc9307db45f6392a2d05b
-
Filesize
1.1MB
MD523bfdad33bfe792bd460fd6acfa2d3ed
SHA1103da1be89e5d57da1321c81c0c52d3c090695ab
SHA25673957ff9ae5b206a795468fc2d4066c120aeb3c8c4f59c69f4520fc7fb03980f
SHA5126dde66bed04f63b95be7798e274a58ab92e93a52a1d7ba2f25dc0e8c48dddc956e86957dd885b3e8619ca45f67b75cffa9a15a850be73a30ec84588ca6a3d147
-
Filesize
1.1MB
MD54fde42661df3627858f8b1d7139a89cb
SHA11dda6af214bbc58ae1c375708b22aa772aab1582
SHA256a840f30a4b4d8814c5ba184cfeb22670adb7e2a99e27dfd575c9840183cd8adb
SHA512ac0b47469ba92b12c1bf62de5371e1b7a1dfa0534ba824ce473124cc1592f58f323256156c94ea7ae57256761ea1996a8253b1310875362c7f6500c60c48cb8b
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
4.4MB
-
Filesize
112KB
-
Filesize
40KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB