Analysis
- max time kernel
92s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
08/06/2024, 14:20
General
- Target Delta V3.61 b_85641026.exe
- Size 9.5MB
- Sample240608-rnx2yadc69
- SHA256 76eee256f1223082e8396611baca498542c656edd0fac5fe903e06e6cb5677e2
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 39 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Delta V3.61 b_85641026.exe"C:\Users\Admin\AppData\Local\Temp\Delta V3.61 b_85641026.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\setup85641026.exeC:\Users\Admin\AppData\Local\setup85641026.exe hhwnd=262610 hreturntoinstaller hextras=id:d8d090d10951db6-AU-KA1rz2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
GenericSetup.LastScreen.dll
GenericSetup.dll
H2OCommonResources.dll
H2ODAL.dll
H2OModels.dll
H2OResources.dll
H2OServices.dll
H2OUtilities.dll
H2OViewModels.dll
HtmlAgilityPack.dll
MyDownloader.Core.dll
MyDownloader.Extension.dll
Newtonsoft.Json.dll
Ninject.dll
OfferSDK.dll
OfferPage.html
SciterWrapper.dll
ServiceHide.Net.dll
ServiceHide.dll
msvcp140.dll
sciter32.dll
vcruntime140.dll
setup85641026.exe
memory/1864-165-0x0000000006440000-0x00000000064CC000-memory.dmp
memory/1864-17-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp
memory/1864-102-0x00000000055D0000-0x00000000055DA000-memory.dmp
memory/1864-94-0x0000000005650000-0x0000000005674000-memory.dmp
memory/1864-86-0x00000000055A0000-0x00000000055BA000-memory.dmp
memory/1864-144-0x0000000005D60000-0x0000000005D72000-memory.dmp
memory/1864-78-0x00000000055E0000-0x0000000005612000-memory.dmp
memory/1864-70-0x0000000005570000-0x0000000005598000-memory.dmp
memory/1864-62-0x0000000005500000-0x000000000552E000-memory.dmp
memory/1864-54-0x00000000054D0000-0x00000000054F8000-memory.dmp
memory/1864-24-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp
memory/1864-38-0x0000000005450000-0x0000000005464000-memory.dmp
memory/1864-118-0x00000000056F0000-0x000000000571C000-memory.dmp
memory/1864-170-0x00000000063C0000-0x00000000063CA000-memory.dmp
memory/1864-18-0x00000000006D0000-0x0000000000AA8000-memory.dmp
memory/1864-46-0x00000000054A0000-0x00000000054C4000-memory.dmp
memory/1864-178-0x0000000006D30000-0x0000000006D3C000-memory.dmp
memory/1864-181-0x0000000007310000-0x00000000078B4000-memory.dmp
memory/1864-172-0x0000000006870000-0x0000000006BC4000-memory.dmp
memory/1864-187-0x0000000007E80000-0x0000000008434000-memory.dmp
memory/1864-198-0x0000000006F80000-0x0000000007012000-memory.dmp
memory/1864-128-0x0000000005680000-0x000000000569D000-memory.dmp
memory/1864-171-0x0000000006840000-0x0000000006862000-memory.dmp
memory/1864-215-0x0000000008570000-0x000000000859E000-memory.dmp
memory/1864-110-0x00000000056A0000-0x00000000056A8000-memory.dmp
memory/1864-243-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp