f58b07195184337a73c5936fbdd0467800657d4b8890c4329e7291bd2834792d

Analysis

max time kernel
449s
max time network
450s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
08/06/2024, 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

startup.exe
Size

4.3MB
MD5

5aad72df3124c0114273a68064b10835
SHA1

a29b8a22b34b417b8a63a6321535b535708ec66b
SHA256

f58b07195184337a73c5936fbdd0467800657d4b8890c4329e7291bd2834792d
SHA512

5da9d1cef6ff4f8514118c92fd36e321fab3b527a24651ff8481cb7da01f7fbd3cff1a4afde5ab395dd8933f9a32eb088f73a56e81b8f63880f3f5fda15d2c3a
SSDEEP

98304:Apq/d8kCBWlMyQjujDW9tBcg2jGqwwArl6zwRGaTfdQ5ekB3tiXn6:hcV5ujyp8jGqww2l6wRGaTfmfNtmn6

Score

7^/10

evasion trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
480	startup.exe

Loads dropped DLL 39 IoCs

pid	Process
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe
480	startup.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	startup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 480	3692	startup.exe	77
PID 3692 wrote to memory of 480	3692	startup.exe	77
PID 3692 wrote to memory of 480	3692	startup.exe	77

C:\Users\Admin\AppData\Local\Temp\startup.exe
"C:\Users\Admin\AppData\Local\Temp\startup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\temp\4576DBE70B52FE110857E6C1E79EF463\startup.exe
  "C:\Windows\temp\4576DBE70B52FE110857E6C1E79EF463\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\startup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  PID:480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\kl.setup.ui.core.dll

Filesize
89KB

MD5
2c8f5ec07cb84d844e3fdee32b2a8e00

SHA1
2e27daffed27a7e6ee3adc50eef1710da318ca32

SHA256
8d5bd8184fbc3f79ea9edc2c25e1a5a935514518c3fba89bde308c06722375f9

SHA512
ef37109b456a68d55dee8a45340e25cb9901909b30f9f882f62060951bec20d838561dbe5ebe0480aa2feb668c6ffbb2137ed2f69cd3d6337c6f38cf395f6eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\kl.setup.ui.dll

Filesize
278KB

MD5
1bebc399a1b31eabc3361169df0316d1

SHA1
56091143fafa680dc65dd5f2b5d6fafa94590041

SHA256
894914e74da8c8faf8bb9b34e0f9b586db3cb248c3f6edb715a7cb8c930dd66b

SHA512
d0d1fb7e23391a352f6bb3d5756dbbcd5a3558e0c477b265453931940a223dfa31cafe20232a9d08fbb127158bce325dd8b769e7bb62907be89019cd3f02f1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\kl.setup.ui.interoplayer.dll

Filesize
56KB

MD5
baf69d3c6977161e0c2b631b3f9958d4

SHA1
a1b2982c11811c4e5f6bce95f3072a855d11c369

SHA256
e6392d0cf3a5984034ca0b346476d7482243550ddd0c65a8c0ff2f03a15867bc

SHA512
2fb765d07638d239b666d4043f9ae75e91dc271ddf399dfe5bfd1c894bcabb95e6e965b478f5208687d9ebaa18cdafd6fc3400cd47694fd9db4ac30f3f1d5839

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\kl.setup.ui.visuals.dll

Filesize
420KB

MD5
6181240bc579d2dfb176a1ca260f5a90

SHA1
eb13b6cd4a242c8399396795d1863954b8d79507

SHA256
b07c4d99d4cbb62b31a425e60c993b809c7043518a9ef0b7b561abd180a1b768

SHA512
f5bb4bdd05836c494a560dc9aa16d62d29b90df7c5854d4a97b8e274890dd1476de955637237867a666c1f08785f5dc06d571e023b124530ee87cf6fdb98689f

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\kl.ui.framework.dll

Filesize
264KB

MD5
2ad2ab4f8517da8e2efdfed22ad49f1e

SHA1
55916e3e5c4c40cf2e5644fbad07baf31459673e

SHA256
6efe8efc6701c80d59ad33bd139aeca1b47a27f49d3ccc16ed01a49da9bfc2e7

SHA512
12800c7d475af627c98cecb6e6c2de8247094166126978e24bd8be3f7193828781e853ee10b3133c989d625f0e2860ce4551369d864748b70db4ec220c515bbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\kl.ui.framework.localization.dll

Filesize
283KB

MD5
079ac68d4beb2ab9602d754b09ff652b

SHA1
90032834cc5cffd0b00119e4e38b5f4c5f877e4c

SHA256
9377c35b19c30ee75c010b1e592796daf1d3493b397ef9d61a1c63a5ab30a88e

SHA512
53782adc516950888ec69b21e744fe4d7f8567223e7c067e362800c78e3621dc148d5aa19f6011962bece1ada3691ef1ef40838a8072480c54aeedb2f4e0c9b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\kl.ui.framework.uikit.b2c.dll

Filesize
631KB

MD5
445e34aa976419cae54e13ede8d41ce5

SHA1
98ca3ee808f97ae16970b0fcefd3387bd07278eb

SHA256
a255bb5dfaa685d7443dbc8bb7fca71417c8f0b1f617ade7077ee437a23a9b24

SHA512
86b4084cf781d4efbb814fce3ed6ca48addbf4c15c5ed3630673350cf65056a80e2a9bc00581a45ae370a64f0bc720d506622eccd9d7ef170814faab1cce14c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\kl.ui.framework.uikit.dll

Filesize
2.7MB

MD5
18defb1e3b7460f592a8ca61e4b40ff0

SHA1
8f8f7d7d1ee8a048d162603cc21a0f4c40b9036b

SHA256
02a884babc5584fec80b227eb1c52dc800c516f1117ff9637617ad84c632da9d

SHA512
7cbdc0c113a0c7ff9628674a8a23f4224290455d4a9a41a66889d01baf1f28b0175197c3078a791ecf6b2052c3fdfc35cf38cfae5bf5917bde80f82499d40b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\setup.dll

Filesize
5.5MB

MD5
0aa12d4ad90f02f8dd6e90df9d3ebc12

SHA1
8d0f0b39725799a80afda7e9d07ffbffed0e39e5

SHA256
03c2e0033b5e56335d735c46eb529825437c7cd922d34dda011e92589753b059

SHA512
6aef22c54d7c3457d4c03e3eb4df801f7901d38035cf52f4cb4d778a636f6f8b629a496ded708a326a3e762065ea39db774af94c6142983e08131916531b60e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\sharpvectorconverterswpf.dll

Filesize
137KB

MD5
a56a73b39703d5ff85b5cf12f9b00009

SHA1
e6448c87f969e19ae4c6514d69d8286d26a2b5db

SHA256
bb5966185017d904d2d7fd952bcc6d5c19fdf6bbbe34ab29c63a3784cd1074c7

SHA512
7fa07a1fcc0735186ee71b3c123b1c4076f04dba5ad319588ea695ef117ab7c39918593e4ee42f18cbd3fe01d043e896981ca6f07293fc2fb0a9bce5d66992b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\sharpvectorcore.dll

Filesize
201KB

MD5
24e3b7177eeabdf085a01796b49c8e55

SHA1
6916a0bb98892252f59692fd0405e6da62af0f8b

SHA256
eab963926cf2d62b575c6f33804372fea04db328b2b3f0adfb45fee3f27e5386

SHA512
5e377e609673f3d84e22d070012578b8a18fce848a3815d9da05e10043d3e9fde8070094d1841acb44a4f876d8741e371a5fbcc86cce80cdf826131370a41e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\sharpvectorcss.dll

Filesize
109KB

MD5
726d04bbe783a3510b18a491adac05c0

SHA1
11a01c68204dd80b32c01dcdb2e51f5b0ee34d98

SHA256
639e091c9e87986eaf9fe00f0f401834e14878ebc48084697fd4307713a065ca

SHA512
90592ddef83b6640cf8f28f0818098f95acc4139c7b3f5e8afa63bb873530be1613d42ee02dae12160737ee612187fc0139e19ee4a7f1abb3fec1fcaee1ae297

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\sharpvectordom.dll

Filesize
55KB

MD5
e4f6efef27708458ecda4ee22edf3cef

SHA1
07ccb5fa980dead816737ad83802cbfed18e4a4f

SHA256
413e485d8dd07231d70107d86ee1a17ce705517aed8346b4701747d1fdbfdfc3

SHA512
4920e508304df14041df1189938a1102e4a71e2e57ac4b9b804b6b0405c89c8292012a5ff4dae21268204ed6d9b56a279f4ce18d709074d1cba71cc9d5e11a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\sharpvectormodel.dll

Filesize
998KB

MD5
225a73e5a0cf87453832b578db6daddb

SHA1
a36717a1b2c7eb2ba160fec5fa80e48b9e57c4ac

SHA256
0499708762c56b9339c980e731ffab294e9b18362af3dcb4ad4481f1c7bd60c1

SHA512
565ee2105bd626650857e0e6f9c8f7d87a68c3ec41923de119a3b710038a4785e16ccf79feb4c1c4f8a308f682163089228ac4ac81295cea754ae1189311c965

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\sharpvectorrenderingwpf.dll

Filesize
203KB

MD5
faec58e7785c287a7c688f274207048d

SHA1
66c038c720035b7212a7d3733da4520e3b95d63b

SHA256
4c76dd0441a8021a308be24cf0c1957bee280451abcc1467acf47f1a6f7f5dce

SHA512
9269a91a5bab01f076d8e9fde2991463fb224dc6382f8cde3a118e83cb35bdf580b4ea7686f2ea767a2a9c04650222edfc3a8b2569978b734c51b7135915448e

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A97CEE70B52FE110857E6C1E79EF463\sharpvectorruntimewpf.dll

Filesize
69KB

MD5
0e203d24d04e89779638dd70d5335b39

SHA1
98ffc3718c6e34bd6d696bbcce605db666f99b01

SHA256
f15b5199850b8ed98d2202972ada759823a17893a68d60ca3a0f76ee31aeb204

SHA512
a07f54cce2add948340807b8ecf430e72c07032332046e5dd05d9da90f7d732921c0ff628592ff0710914ec9d9b7188b46377e1594a9f9809a107a022de1cfee

Download Submit
C:\Windows\Temp\4576DBE70B52FE110857E6C1E79EF463\startup.exe

Filesize
4.3MB

MD5
5aad72df3124c0114273a68064b10835

SHA1
a29b8a22b34b417b8a63a6321535b535708ec66b

SHA256
f58b07195184337a73c5936fbdd0467800657d4b8890c4329e7291bd2834792d

SHA512
5da9d1cef6ff4f8514118c92fd36e321fab3b527a24651ff8481cb7da01f7fbd3cff1a4afde5ab395dd8933f9a32eb088f73a56e81b8f63880f3f5fda15d2c3a

Download Submit
memory/480-50-0x0000000005EE0000-0x0000000005F26000-memory.dmp

Filesize
280KB

Download
memory/480-137-0x0000000006460000-0x0000000006492000-memory.dmp

Filesize
200KB

Download
memory/480-52-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/480-84-0x0000000006C30000-0x0000000006C46000-memory.dmp

Filesize
88KB

Download
memory/480-51-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/480-88-0x0000000006FA0000-0x0000000006FE8000-memory.dmp

Filesize
288KB

Download
memory/480-190-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/480-92-0x00000000072B0000-0x0000000007570000-memory.dmp

Filesize
2.8MB

Download
memory/480-93-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/480-44-0x00000000034B0000-0x00000000034BE000-memory.dmp

Filesize
56KB

Download
memory/480-97-0x0000000007950000-0x00000000079BA000-memory.dmp

Filesize
424KB

Download
memory/480-40-0x0000000073FEE000-0x0000000073FEF000-memory.dmp

Filesize
4KB

Download
memory/480-109-0x0000000007CA0000-0x0000000007D3E000-memory.dmp

Filesize
632KB

Download
memory/480-121-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/480-128-0x00000000061B0000-0x00000000061E4000-memory.dmp

Filesize
208KB

Download
memory/480-11-0x0000000077A14000-0x0000000077A15000-memory.dmp

Filesize
4KB

Download
memory/480-132-0x00000000061F0000-0x0000000006212000-memory.dmp

Filesize
136KB

Download
memory/480-7-0x0000000077B50000-0x0000000077B60000-memory.dmp

Filesize
64KB

Download
memory/480-133-0x00000000062C0000-0x0000000006352000-memory.dmp

Filesize
584KB

Download
memory/480-80-0x00000000067D0000-0x0000000006812000-memory.dmp

Filesize
264KB

Download
memory/480-8-0x0000000077B50000-0x0000000077B60000-memory.dmp

Filesize
64KB

Download
memory/480-149-0x00000000064C0000-0x00000000064CE000-memory.dmp

Filesize
56KB

Download
memory/480-9-0x0000000077B50000-0x0000000077B60000-memory.dmp

Filesize
64KB

Download
memory/480-145-0x0000000007AC0000-0x0000000007ADC000-memory.dmp

Filesize
112KB

Download
memory/480-189-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/480-153-0x0000000008460000-0x0000000008472000-memory.dmp

Filesize
72KB

Download
memory/480-188-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/480-141-0x0000000008540000-0x000000000863A000-memory.dmp

Filesize
1000KB

Download
memory/480-187-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/480-163-0x000000000C4D0000-0x000000000C508000-memory.dmp

Filesize
224KB

Download
memory/480-164-0x000000000C4A0000-0x000000000C4AE000-memory.dmp

Filesize
56KB

Download
memory/480-183-0x000000000C090000-0x000000000C098000-memory.dmp

Filesize
32KB

Download
memory/480-184-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/480-185-0x0000000073FEE000-0x0000000073FEF000-memory.dmp

Filesize
4KB

Download
memory/480-186-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/3692-2-0x0000000077B70000-0x0000000077B80000-memory.dmp

Filesize
64KB

Download
memory/3692-0-0x0000000077B70000-0x0000000077B80000-memory.dmp

Filesize
64KB

Download
memory/3692-3-0x0000000077A14000-0x0000000077A15000-memory.dmp

Filesize
4KB

Download
memory/3692-1-0x0000000077B70000-0x0000000077B80000-memory.dmp

Filesize
64KB

Download