Analysis
-
max time kernel
149s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
23-05-2024 01:46
General
-
Target
SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe
-
Size
3.2MB
-
MD5
2d083e880e7dc3554f2561bcf21cd23d
-
SHA1
8aa9e9f69636a354722cf7e3fc391e9a510e19c9
-
SHA256
6b3f1414d14cda0b582420ffe7f1484356882fcc21e7fb1a19ab86008ca57b70
-
SHA512
7a390b76401823cef95dcab3a2c6ae21fc958f3a1dbb7384183ee4cd2698debf37a7c4802b8a56ae62a5c6924c3cb6b99d4cb4e07453633622d807e43d361379
-
SSDEEP
49152:zqe3f6Rz4O5RLa6I8SwvMHDB+q0gabxS5xru87+DjqVX5rIJwI2J5PiH7nBGtm:uSiRz4iRPsA9f85xSLjgJLTiH7BUm
Malware Config
Signatures
-
Downloads MZ/PE file
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 7 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-25B8N.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.tmp"C:\Users\Admin\AppData\Local\Temp\is-25B8N.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.tmp" /SL5="$40206,2484213,893952,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg4MjYsImRpc3RpbmN0X2lkIjoiRjM3Mjg5QjgtODU0My00N0UyLUFGNTEtNUFGMjFFRTVGQURGIiwiZGVmYXVsdF9icm93c2VyIjoiTVNFZGdlSFRNIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImIiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImEiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MM8HK.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.tmp"C:\Users\Admin\AppData\Local\Temp\is-MM8HK.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.tmp" /SL5="$70212,2484213,893952,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg4MjYsImRpc3RpbmN0X2lkIjoiRjM3Mjg5QjgtODU0My00N0UyLUFGNTEtNUFGMjFFRTVGQURGIiwiZGVmYXVsdF9icm93c2VyIjoiTVNFZGdlSFRNIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImIiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImEiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe"C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg4MjYsImRpc3RpbmN0X2lkIjoiRjM3Mjg5QjgtODU0My00N0UyLUFGNTEtNUFGMjFFRTVGQURGIiwiZGVmYXVsdF9icm93c2VyIjoiTVNFZGdlSFRNIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImIiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImEiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-691AC.tmp\OneLaunch Setup_.tmp"C:\Users\Admin\AppData\Local\Temp\is-691AC.tmp\OneLaunch Setup_.tmp" /SL5="$10246,105340057,893952,C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg4MjYsImRpc3RpbmN0X2lkIjoiRjM3Mjg5QjgtODU0My00N0UyLUFGNTEtNUFGMjFFRTVGQURGIiwiZGVmYXVsdF9icm93c2VyIjoiTVNFZGdlSFRNIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImIiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImEiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=6⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5c0e3f092b137ef1604c7e1b31a755e06
SHA1c09c89a30537d2d5f1fe21f46ec1459ec2479a00
SHA2561829c12b58954d0d71389acd73da79d13e2571acd1eeae3cf48273ceaba98d31
SHA5122a1301d966a89b017d8f32084d9061df25bcf7d8a7ebc6da47664c784fd8e523f80b63d2830429b37bab94dcf5337cf689b823fa24280a9a125ab6ddf366e5d1
-
Filesize
3.0MB
MD581f40127b8567ea5f7d94059751951d7
SHA1750d2616e7f3068171f06f610b2a239b56fa9ad7
SHA25690d52bc27d2fb921014664fe4ae774436d382ae58037a0d58f25bce33b5b551a
SHA51268bb44476c950a37dc90786911c3fa4a28c5bf6af9416ad06e050a421c7e52f68f5b1ebe24d9dea7ca1a5ddbc45632962c9a2133c0aef00b07f063c4ea193bbc
-
Filesize
46KB
MD5f801d3a6f441e1475342906bae8b73e8
SHA1e2a5a128afda6b2bfe7ff4c4225b28bf5b0e2aec
SHA256dadb7c8637d9b9d6f0f36b110d324bbeb80e3ccffd8e376235857a0162de090c
SHA512ce893b13b55078059ac7e5898393e14321966a54ee660b29b916baa3de0cfb99aa7d296b26ae566e2ce4321c57a8b2fa38f5a2d567c49a95e363e08705ddbf2a
-
Filesize
70KB
MD5d3110fb775ee7fd24426503d67840c25
SHA154f649c8bf3af2ad3a4d92cd8b1397bad1a49a75
SHA256f8392390dc81756e79ec5f359dbdcac3b4bd219b5188a429b814fc51aabb6e36
SHA512f6b79f728be17c9060edb2df2dac2b0f59a4dffd8c416e7e957bc3fa4696f4237e5969647309f5425a6297f189e351e20c99c642f90d1476050285929657c32f
-
Filesize
363B
MD5a4d4dc66a41d9c3b54a2ed3ee8d4b3df
SHA1e91a5e7a6690c14c6f799e2433beb2f6388c4df6
SHA25646e9c171e2115cd43e5d05f6a5f6015b27bda065fbab939916fee2fd5c06d5a4
SHA51299d5425aa653b93d0b6065020f88c095c39d982fb20a0ed0078418e8e862a104b4f0392791c79d2df86410a0ba5ba60e644852943a9fc602f7eaf82fecaaefd4
-
Filesize
5KB
MD52257b1d0d33a41f509e7c3e117819f8b
SHA187583bfbc655aec4e8cc4465b341c3f7889a6317
SHA256d43e4b285b5b54313b53e87d2a56ca9ba0c85f8f55c9c5fdcdb4fac815ff4d02
SHA512702d1a126a0a7a64af5cee9450daeed74364aa9e9f123e1bc398ecd4215c082e7f55e43dd292a4119749e84999b015109bff8b11732df11143d202b385411cc5
-
Filesize
24KB
MD52484489c7443ec4745488a77ed084d80
SHA1fcf49d1be8bbbae3d0dea49bb5e677fb19d98d9d
SHA25670b6921812f29b698f454927802db818c1625402baefd53ced1bfb9135c17d5a
SHA512a4776969b6bf215a85e7cfbc8f13dbb1beb4ef42eb5abfa572bb7f54c0032941c8bb178e7b77eda0c442741c29fccb02d8de157068dd31203bfed4e49ce051a5
-
Filesize
725KB
MD500de2dff1787f6d7904189476b307bfb
SHA1098a2c23f651d08730927adc8c63518744b199f9
SHA256cc24488a078d3e92dd7dfb96c22cebd4004ee7fcb297a438e2d3848b633a9f71
SHA51233a06affebca41e4580279d3ab0f5a2e798584f1ac7f15a19b2364825caba06d8cf57d4ea1ae15bb41d7b14b6ed48f0d3f472c4a4231b7ff792bfca97e93250f
-
Filesize
1.2MB
-
Filesize
584KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.0MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.0MB
-
Filesize
80KB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
80KB
-
Filesize
3.0MB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
728KB
-
Filesize
3.0MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.0MB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
