Analysis
- max time kernel
115s - max time network
273s - platform
windows11-21h2_x64 - resource
win11-20240611-en - resource tags
- submitted
13/06/2024, 12:25
General
- Target Setup.exe
- Size 673.3MB
- Sample240613-pltwdsycrf
- SHA256 585c3de663601b57595ee5bdfa730fc856d2d5cd9253fc1b105f11467dc1b557
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Eoin.pifC:\Users\Admin\AppData\Local\Temp\Eoin.pif3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Eoin.pif
ad830b91
af2de327
memory/1888-15-0x00007FFCE48C0000-0x00007FFCE4AC9000-memory.dmp
memory/1888-31-0x00000000760AE000-0x00000000760B0000-memory.dmp
memory/1888-22-0x00000000760A0000-0x0000000076104000-memory.dmp
memory/1888-18-0x00000000760AE000-0x00000000760B0000-memory.dmp
memory/1888-19-0x00000000760A0000-0x0000000076104000-memory.dmp
memory/1888-17-0x00000000760A0000-0x0000000076104000-memory.dmp
memory/2988-25-0x00007FFCE48C0000-0x00007FFCE4AC9000-memory.dmp
memory/2988-26-0x0000000000010000-0x000000000006C000-memory.dmp
memory/2988-27-0x00000000760A0000-0x0000000076104000-memory.dmp
memory/2988-28-0x0000000000010000-0x000000000006C000-memory.dmp
memory/2988-30-0x00000000760A0000-0x0000000076104000-memory.dmp
memory/4516-11-0x00007FFCE3920000-0x00007FFCE398F000-memory.dmp
memory/4516-9-0x00007FFCE3938000-0x00007FFCE3939000-memory.dmp
memory/4516-10-0x00007FFCE3920000-0x00007FFCE398F000-memory.dmp
memory/4516-8-0x00007FFCE3920000-0x00007FFCE398F000-memory.dmp
memory/4516-1-0x0000000000400000-0x0000000000F66000-memory.dmp
memory/4516-0-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/4516-2-0x0000000002D80000-0x0000000002D81000-memory.dmp