Resubmissions
09-05-2024 14:33
240509-rxayrsee7v 809-05-2024 13:32
240509-qs211sca4z 809-05-2024 13:30
240509-qr7j4sbh9s 709-05-2024 13:07
240509-qc3bvaba7v 8Analysis
-
max time kernel
22s -
max time network
18s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 13:30
Static task
static1
Behavioral task
behavioral1
Sample
innosetup-6.2.2 (1).exe
Resource
win10v2004-20240426-en
General
-
Target
innosetup-6.2.2 (1).exe
-
Size
4.5MB
-
MD5
2893b10c36fddb20a38e9b8b9a44d647
-
SHA1
9ab6a2f797d5efc3c5c3985d48fc63c6a111f643
-
SHA256
8117d10d00a2ad33a1390978ea3872861c330e087914410a6377b22c4c5b8563
-
SHA512
496375b1ce9c0d2f8eb3930ebd8366f5c4c938bc1eda47aed415e3f02bd8651a84a770a15f2825bf3c8ed9dbefa355b9eb805dd76bc782f6d8c8096d80443099
-
SSDEEP
98304:6kLsYMYXKk7jmHED1W+Q6zBcLOYCwOo5mympFVWkj6Z:VsoJ7SHElRcLFEo5yhWkj6Z
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
innosetup-6.2.2 (1).tmppid process 2484 innosetup-6.2.2 (1).tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
innosetup-6.2.2 (1).exedescription pid process target process PID 2072 wrote to memory of 2484 2072 innosetup-6.2.2 (1).exe innosetup-6.2.2 (1).tmp PID 2072 wrote to memory of 2484 2072 innosetup-6.2.2 (1).exe innosetup-6.2.2 (1).tmp PID 2072 wrote to memory of 2484 2072 innosetup-6.2.2 (1).exe innosetup-6.2.2 (1).tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.2 (1).exe"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.2 (1).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\is-906F6.tmp\innosetup-6.2.2 (1).tmp"C:\Users\Admin\AppData\Local\Temp\is-906F6.tmp\innosetup-6.2.2 (1).tmp" /SL5="$401C8,3752627,832512,C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.2 (1).exe"2⤵
- Executes dropped EXE
PID:2484
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD51a860ade3cf55b75dca48e96e5a7fb65
SHA1595e3d6255f52792c62e7e3c6e1c17039da1b813
SHA2567d1aa4fa34882122afe88fab6b14b97ef75f26e41dcfefd606f17444016b46aa
SHA512ec7a49e257863b3dee39c1352b8fd65d3e4a6e4941f74a2082d92b41971d3f73d1ecc44d9ea64c7ce715117e1a1e4316b3631290425a967b4e3678d1cbd5b409