Overview

overview

8

Static

static

1

setup-inst...23.exe

windows7-x64

7

setup-inst...23.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    290s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    04-05-2024 15:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup-install-geneatique-2023.exe

  • Size

    523KB

  • MD5

    edaa606e36622434054c0673cf6af1cb

  • SHA1

    2a66889c5f759a95109aca702c15a7ce1b0a0094

  • SHA256

    aaabb8a454e51e5069dc3757ad5a01cedeb291f83116091519839f900cc8c70f

  • SHA512

    aa65ade0839f095e0bf6b8ea907eaa78d704aa3645bfddf330b621c40cdda045fe0ec2aaea18e48e813e545c8d636f17941dbb0d42f28024ac14fd2c8592888e

  • SSDEEP

    12288:dS3yBV888888888888W88888888888wyGtORzK/AA9i6Zub02O9HtFbXaT2K:w3yyy0Z/D9kqtZaT2K

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup-install-geneatique-2023.exe
    "C:\Users\Admin\AppData\Local\Temp\setup-install-geneatique-2023.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Users\Admin\AppData\Local\Temp\is-DIO01.tmp\setup-install-geneatique-2023.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DIO01.tmp\setup-install-geneatique-2023.tmp" /SL5="$30144,137088,114176,C:\Users\Admin\AppData\Local\Temp\setup-install-geneatique-2023.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-DIO01.tmp\setup-install-geneatique-2023.tmp
    Filesize

    1.1MB

    MD5

    f120c361b527a9d090782300aa8f1ce5

    SHA1

    ed82441da0dc7a5695ef96839fc2aea0f0c7e376

    SHA256

    9209a83ac4b0127081327b6e03960e2a4325dbb31f0bba2b56dfb785583f9825

    SHA512

    60fc418c4296f67b923e1fff4e6034ed41eeba61604b14d560cfd84e7476b59311c6029aee7ee602d8fdc635107855e5c05dcf6a0137c6ba89db7134e63e5555

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-G5P0O.tmp\_isetup\_shfoldr.dll
    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-G5P0O.tmp\isxdl.dll
    Filesize

    58KB

    MD5

    21a40ade8a7a6f96dd51958d919493b8

    SHA1

    f22ae3aa54975272899dcafd2c5daa145b0197d9

    SHA256

    f18408b25ac74e69fb022d8ac5154bbfe4fd59288c3884f172e4895699d70fdf

    SHA512

    19795ed2f8fa6fa6705570e511b3ddaefa3bdb8451c6c68fb2a883875f8fd0b7d7a90a61d4bb6cc4800d5159e0cb8f04ce342a79894d78fb275db1af81e3cd45

    Download Submit
  • memory/1624-2-0x0000000000401000-0x0000000000410000-memory.dmp
    Filesize

    60KB

    Download
  • memory/1624-0-0x0000000000400000-0x0000000000425000-memory.dmp
    Filesize

    148KB

    Download
  • memory/1624-19-0x0000000000400000-0x0000000000425000-memory.dmp
    Filesize

    148KB

    Download
  • memory/2228-14-0x0000000000400000-0x0000000000529000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2228-20-0x0000000000400000-0x0000000000529000-memory.dmp
    Filesize

    1.2MB

    Download