Overview

overview

6

Static

static

1

SecuriteIn...54.exe

windows7-x64

6

SecuriteIn...54.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 01:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe

  • Size

    3.2MB

  • MD5

    2d083e880e7dc3554f2561bcf21cd23d

  • SHA1

    8aa9e9f69636a354722cf7e3fc391e9a510e19c9

  • SHA256

    6b3f1414d14cda0b582420ffe7f1484356882fcc21e7fb1a19ab86008ca57b70

  • SHA512

    7a390b76401823cef95dcab3a2c6ae21fc958f3a1dbb7384183ee4cd2698debf37a7c4802b8a56ae62a5c6924c3cb6b99d4cb4e07453633622d807e43d361379

  • SSDEEP

    49152:zqe3f6Rz4O5RLa6I8SwvMHDB+q0gabxS5xru87+DjqVX5rIJwI2J5PiH7nBGtm:uSiRz4iRPsA9f85xSLjgJLTiH7BUm

Score
6/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 7 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5092
    • C:\Users\Admin\AppData\Local\Temp\is-BG2PU.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BG2PU.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.tmp" /SL5="$C0034,2484213,893952,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2132
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg3NzEsImRpc3RpbmN0X2lkIjoiQzVEMjVFODEtRjQwOS00NUFELTlCOEQtRTUwNkQ1RDlEMkIwIiwiZGVmYXVsdF9icm93c2VyIjoiTVNFZGdlSFRNIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImIiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImEiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3592
        • C:\Users\Admin\AppData\Local\Temp\is-Q3KES.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-Q3KES.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.tmp" /SL5="$90200,2484213,893952,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg3NzEsImRpc3RpbmN0X2lkIjoiQzVEMjVFODEtRjQwOS00NUFELTlCOEQtRTUwNkQ1RDlEMkIwIiwiZGVmYXVsdF9icm93c2VyIjoiTVNFZGdlSFRNIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImIiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImEiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:3336
          • C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe
            "C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg3NzEsImRpc3RpbmN0X2lkIjoiQzVEMjVFODEtRjQwOS00NUFELTlCOEQtRTUwNkQ1RDlEMkIwIiwiZGVmYXVsdF9icm93c2VyIjoiTVNFZGdlSFRNIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImIiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImEiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4064
            • C:\Users\Admin\AppData\Local\Temp\is-IE3G5.tmp\OneLaunch Setup_.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-IE3G5.tmp\OneLaunch Setup_.tmp" /SL5="$1022A,105340057,893952,C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg3NzEsImRpc3RpbmN0X2lkIjoiQzVEMjVFODEtRjQwOS00NUFELTlCOEQtRTUwNkQ1RDlEMkIwIiwiZGVmYXVsdF9icm93c2VyIjoiTVNFZGdlSFRNIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImIiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImEiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:3500

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-BG2PU.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.tmp
    Filesize

    3.0MB

    MD5

    c0e3f092b137ef1604c7e1b31a755e06

    SHA1

    c09c89a30537d2d5f1fe21f46ec1459ec2479a00

    SHA256

    1829c12b58954d0d71389acd73da79d13e2571acd1eeae3cf48273ceaba98d31

    SHA512

    2a1301d966a89b017d8f32084d9061df25bcf7d8a7ebc6da47664c784fd8e523f80b63d2830429b37bab94dcf5337cf689b823fa24280a9a125ab6ddf366e5d1

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-CQ83M.tmp\checkmark-10-light.png
    Filesize

    363B

    MD5

    a4d4dc66a41d9c3b54a2ed3ee8d4b3df

    SHA1

    e91a5e7a6690c14c6f799e2433beb2f6388c4df6

    SHA256

    46e9c171e2115cd43e5d05f6a5f6015b27bda065fbab939916fee2fd5c06d5a4

    SHA512

    99d5425aa653b93d0b6065020f88c095c39d982fb20a0ed0078418e8e862a104b4f0392791c79d2df86410a0ba5ba60e644852943a9fc602f7eaf82fecaaefd4

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-CQ83M.tmp\min-10-light.png
    Filesize

    5KB

    MD5

    2257b1d0d33a41f509e7c3e117819f8b

    SHA1

    87583bfbc655aec4e8cc4465b341c3f7889a6317

    SHA256

    d43e4b285b5b54313b53e87d2a56ca9ba0c85f8f55c9c5fdcdb4fac815ff4d02

    SHA512

    702d1a126a0a7a64af5cee9450daeed74364aa9e9f123e1bc398ecd4215c082e7f55e43dd292a4119749e84999b015109bff8b11732df11143d202b385411cc5

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-CQ83M.tmp\min-rest.bmp
    Filesize

    24KB

    MD5

    2484489c7443ec4745488a77ed084d80

    SHA1

    fcf49d1be8bbbae3d0dea49bb5e677fb19d98d9d

    SHA256

    70b6921812f29b698f454927802db818c1625402baefd53ced1bfb9135c17d5a

    SHA512

    a4776969b6bf215a85e7cfbc8f13dbb1beb4ef42eb5abfa572bb7f54c0032941c8bb178e7b77eda0c442741c29fccb02d8de157068dd31203bfed4e49ce051a5

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-CQ83M.tmp\onelaunch.bmp
    Filesize

    725KB

    MD5

    00de2dff1787f6d7904189476b307bfb

    SHA1

    098a2c23f651d08730927adc8c63518744b199f9

    SHA256

    cc24488a078d3e92dd7dfb96c22cebd4004ee7fcb297a438e2d3848b633a9f71

    SHA512

    33a06affebca41e4580279d3ab0f5a2e798584f1ac7f15a19b2364825caba06d8cf57d4ea1ae15bb41d7b14b6ed48f0d3f472c4a4231b7ff792bfca97e93250f

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-IE3G5.tmp\OneLaunch Setup_.tmp
    Filesize

    3.0MB

    MD5

    81f40127b8567ea5f7d94059751951d7

    SHA1

    750d2616e7f3068171f06f610b2a239b56fa9ad7

    SHA256

    90d52bc27d2fb921014664fe4ae774436d382ae58037a0d58f25bce33b5b551a

    SHA512

    68bb44476c950a37dc90786911c3fa4a28c5bf6af9416ad06e050a421c7e52f68f5b1ebe24d9dea7ca1a5ddbc45632962c9a2133c0aef00b07f063c4ea193bbc

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-REOMH.tmp\Win32Library.dll
    Filesize

    46KB

    MD5

    f801d3a6f441e1475342906bae8b73e8

    SHA1

    e2a5a128afda6b2bfe7ff4c4225b28bf5b0e2aec

    SHA256

    dadb7c8637d9b9d6f0f36b110d324bbeb80e3ccffd8e376235857a0162de090c

    SHA512

    ce893b13b55078059ac7e5898393e14321966a54ee660b29b916baa3de0cfb99aa7d296b26ae566e2ce4321c57a8b2fa38f5a2d567c49a95e363e08705ddbf2a

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-REOMH.tmp\onelaunch.png
    Filesize

    70KB

    MD5

    d3110fb775ee7fd24426503d67840c25

    SHA1

    54f649c8bf3af2ad3a4d92cd8b1397bad1a49a75

    SHA256

    f8392390dc81756e79ec5f359dbdcac3b4bd219b5188a429b814fc51aabb6e36

    SHA512

    f6b79f728be17c9060edb2df2dac2b0f59a4dffd8c416e7e957bc3fa4696f4237e5969647309f5425a6297f189e351e20c99c642f90d1476050285929657c32f

    Download Submit
  • memory/2132-7-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2132-48-0x00000000037C0000-0x0000000003900000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2132-44-0x00000000037C0000-0x0000000003900000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2132-45-0x00000000037C0000-0x0000000003900000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2132-94-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2132-47-0x00000000037C0000-0x0000000003900000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2132-27-0x0000000073D10000-0x0000000073D24000-memory.dmp
    Filesize

    80KB

    Download
  • memory/2132-49-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2132-46-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2132-51-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2132-54-0x00000000037C0000-0x0000000003900000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2132-59-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2132-28-0x0000000008FD0000-0x0000000009062000-memory.dmp
    Filesize

    584KB

    Download
  • memory/2132-22-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2132-26-0x0000000008FB0000-0x0000000008FC4000-memory.dmp
    Filesize

    80KB

    Download
  • memory/3336-163-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/3500-106-0x000000006F6A0000-0x000000006F6B4000-memory.dmp
    Filesize

    80KB

    Download
  • memory/3500-105-0x0000000008F70000-0x0000000008F84000-memory.dmp
    Filesize

    80KB

    Download
  • memory/3500-95-0x0000000003680000-0x00000000037C0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/3500-165-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/3500-96-0x0000000003680000-0x00000000037C0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/3592-162-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/3592-62-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/3592-60-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/4064-164-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/4064-78-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/5092-50-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/5092-2-0x0000000000401000-0x00000000004B7000-memory.dmp
    Filesize

    728KB

    Download
  • memory/5092-161-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/5092-0-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download