757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b

Analysis

max time kernel
144s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
14/05/2024, 03:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iobituninstaller.exe
Size 27.8MB
Sample240514-dx65bagh8t
SHA256 757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b
MD5 5ade52a10d29ead2af1cac7679c1c629
SHA1 93270f994fc783904bc44117a57ec910f9c8e2f2
SHA512 8a6e1add19f016061262daef315bf9bc8b9d842ea2bef815a07faa2b6d090234a2a68bca89c0c0f38a07e3ed684407be0dc317b922360333b6c1459d30c03301
SSDEEP 393216:rzw1/c86RK7WETJDvrb9nBE425Qa6awhOZzXhZ1tFOn2C4U7/IYhGuu0MGJjQad:41/SitOVwhK9XK2CX7gHgJd
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1448	iobituninstaller.tmp
2416	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	Setup.exe
2416	Setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	Setup.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1448	2092	iobituninstaller.exe	79
PID 2092 wrote to memory of 1448	2092	iobituninstaller.exe	79
PID 2092 wrote to memory of 1448	2092	iobituninstaller.exe	79
PID 1448 wrote to memory of 2416	1448	iobituninstaller.tmp	82
PID 1448 wrote to memory of 2416	1448	iobituninstaller.tmp	82
PID 1448 wrote to memory of 2416	1448	iobituninstaller.tmp	82

C:\Users\Admin\AppData\Local\Temp\iobituninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\iobituninstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\is-JJUGT.tmp\iobituninstaller.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JJUGT.tmp\iobituninstaller.tmp" /SL5="$40216,28499042,139264,C:\Users\Admin\AppData\Local\Temp\iobituninstaller.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Users\Admin\AppData\Local\Temp\is-9O9PP.tmp\Installer\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-9O9PP.tmp\Installer\Setup.exe" /setup "C:\Users\Admin\AppData\Local\Temp\iobituninstaller.exe" "" "/Ver=13.5.0.1"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iobitpromotion.ini

Path C:\ProgramData\IObit\iobitpromotion.ini
Size 96B
SHA256 e4989b3b02e72bc95b64b5395b4d30478a8c42e94ba6d82aa6bdd734d6f6463b
MD5 06db3aebf311de9b7a73a1a0e6c2f174
SHA1 9970566e057c6d208cfce8b8c2ec705b27f475c9
SHA512 be88968e6ae6cdf36530b99a94a9f7291292ed74ac65b0b41643cd38d3636524337e60945dba16468494cf75ba5dc532665075487572118a0e8efaaa464958ca
MD5 SHA1 SHA512

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-9O9PP.tmp\Setup.exe
Size 5.8MB
SHA256 0c2ec5985c77f45577b027d1a9f75f5c484abd9de723762fb87c74e9ddebeed0
MD5 da7179d9bd82500f700eae8cb8d6e3ab
SHA1 9b2681abde41736f27307b6e61bc07888411c911
SHA512 72f471d36c29f982d70a5e51e3331e320b69b072d9a90057019e2d014bdb4285771775768a3bc713d4b8024ae5a76c833cbd3e77759c287c9210c5526a2a78db
SSDEEP 98304:3npjaY80uKMCpWM/gCd3syAY72zLFLrBIEceB9ceBuH:Xpk0uKRpWqXd3svk2IEceB9ceBQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

iobituninstaller.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-JJUGT.tmp\iobituninstaller.tmp
Size 1.2MB
SHA256 49a99807f43bc7d52757bf753a06f79fa7fb088b1e1a51933cdcb68b4bf224b3
MD5 f5fb27a31d6afc9fdc50f8b712cfafbb
SHA1 f78b8229d9dc4f7e417b61d25d9fd64a9d839d4f
SHA512 8f8b2f0572e53cbc14ea71c4c14e21c7302aec28cb97102c4166f21cf641fe7545d14ae7ed722f7a002504a8ba506f47e00b56ef43e273673bb6b70dcc92bfe9
SSDEEP 24576:KnbbPImgK4brDi4IxgRqzwqNb+Yz73P2EMZbG0JEtM5qx9B3:IHeKh4nqzF3PYdStNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1448-32-0x0000000000400000-0x0000000000532000-memory.dmp

Download

memory/1448-7-0x0000000000400000-0x0000000000532000-memory.dmp

Download

memory/2092-34-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2092-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2092-2-0x0000000000401000-0x0000000000412000-memory.dmp

Download

memory/2416-35-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/2416-36-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/2416-37-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/2416-38-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/2416-62-0x0000000000400000-0x0000000000A16000-memory.dmp

Download