b2990b4e3ebfee9b425d8283d280f3d7c0eccca8aa727050980da4665e3a0bdf

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_26.exe
Size

382KB
MD5

078bf48567a7cea082a128cc31b52f9d
SHA1

488a4a34549e4b88fdbd7dda91d843220d6ab260
SHA256

6ed4f7ca80c88fd175c2e9b4e2dd81d846e24cf10852d7433e5c6e200aca398f
SHA512

5e9e189cb3feab8e8bd80c81456d21d928558dfb1babab9b01f124efa9e4284616ab85d931155d3c3148d88c59b2b253577f4fd953dcc27ccfe0c7570f799520
SSDEEP

6144:HoH3F6lYTB9VxfDGrGZObjKwBZQhR3/pZDvrEiOCWa:IHcYT3VRDajFGB/pZDvAeWa

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1720	amisid.exe

Loads dropped DLL 5 IoCs

pid	Process
2884	setup_26.exe
2884	setup_26.exe
2884	setup_26.exe
2884	setup_26.exe
2884	setup_26.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	2884	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 1720	2884	setup_26.exe	28
PID 2884 wrote to memory of 1720	2884	setup_26.exe	28
PID 2884 wrote to memory of 1720	2884	setup_26.exe	28
PID 2884 wrote to memory of 1720	2884	setup_26.exe	28
PID 2884 wrote to memory of 2832	2884	setup_26.exe	30
PID 2884 wrote to memory of 2832	2884	setup_26.exe	30
PID 2884 wrote to memory of 2832	2884	setup_26.exe	30
PID 2884 wrote to memory of 2832	2884	setup_26.exe	30

C:\Users\Admin\AppData\Local\Temp\setup_26.exe
"C:\Users\Admin\AppData\Local\Temp\setup_26.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\nsiBA6.tmp\amisid.exe
  C:\Users\Admin\AppData\Local\Temp\nsiBA6.tmp\amisid.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 580
  2⤵
  - Program crash
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsiBA6.tmp\NSIS_AntiVmFraud.dll

Filesize
88KB

MD5
c0611351b38e6c292246ef16d5c996e2

SHA1
fd6b07503e21278a11e0812e586d24266a5b3dea

SHA256
1f25aaad57d697c252fd086236862501296d4a06b2d2f02a20d118db0c1ea5b3

SHA512
8338a3ee9c9915daa592cdcdb0bd6f4b7419d535df939cf2facebf947aeb0c3c5c1b4270c6592200ae502a6f438b5a1193ebea78b6a9f5dd9ee6a7692a609aec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiBA6.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiBA6.tmp\nsisos.dll

Filesize
5KB

MD5
69806691d649ef1c8703fd9e29231d44

SHA1
e2193fcf5b4863605eec2a5eb17bf84c7ac00166

SHA256
ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

SHA512
5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiBA6.tmp\registry.dll

Filesize
24KB

MD5
2b7007ed0262ca02ef69d8990815cbeb

SHA1
2eabe4f755213666dbbbde024a5235ddde02b47f

SHA256
0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

SHA512
aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

Download Submit
\Users\Admin\AppData\Local\Temp\nsiBA6.tmp\amisid.exe

Filesize
63KB

MD5
e72a358d9ca068640b71999e3feb6489

SHA1
452de7b0de255467fc113aeab0244a28d9d6ddb4

SHA256
1fde3db9ef2e1e283bd4f8cc7e703f323b8f44dc04865d52939373db2e5ca46d

SHA512
7f622c50261ce98ebeaba06413b1660a08469fc692210927affb3efd014323aaf3d6cbb682ae79579f6fbd2a52121536a3b60b19674d76209f5445f381dc626e

Download Submit
memory/2884-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2884-15-0x0000000002500000-0x0000000002559000-memory.dmp

Filesize
356KB

Download
memory/2884-36-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download