57e90295056333b0de05689523eef17285d034a25a9a1965d789da54af854aee

Analysis

max time kernel
43s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/PW001.exe
Size 879KB
Sample240614-algtha1cpm
SHA256 b65bd44fcbcbe3bd70e1a665dc8f9e8a878c24eb230d0ebf5bf0e1adb017ec01
MD5 4c9ec35033d6049fc2b772d5bd7f063d
SHA1 59fb04eb6a4ea03aa98967683a6bc58be98cd68a
SHA512 720a0d43693cdc5549c204dc352b2d55e65790575cba3f7f35b2a5ee5dce7f1b7c9989c34608d27d335dcc00460a305b500579d7a0959e3419e50af80c099e53
SSDEEP 24576:jG50ZfFK6ln+3Med97Mjn9foX4OoIVRY0dGxsAI02F+02+tsC:jG5UfgQ+/w9fMhGx59Ov
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3260	installer.exe
2300	GenericSetup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2300	GenericSetup.exe
2300	GenericSetup.exe
2300	GenericSetup.exe
2300	GenericSetup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	GenericSetup.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 3260	1968	PW001.exe	82
PID 1968 wrote to memory of 3260	1968	PW001.exe	82
PID 1968 wrote to memory of 3260	1968	PW001.exe	82
PID 3260 wrote to memory of 2300	3260	installer.exe	84
PID 3260 wrote to memory of 2300	3260	installer.exe	84

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PW001.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PW001.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\7zS0B755B07\installer.exe
  .\installer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Users\Admin\AppData\Local\Temp\7zS0B755B07\GenericSetup.exe
    C:\Users\Admin\AppData\Local\Temp\7zS0B755B07\GenericSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BundleConfig.xml

Path C:\Users\Admin\AppData\Local\Temp\7zS0B755B07\BundleConfig.xml
Size 10KB
SHA256 1e1781015cb7b19556b9613a758a61b4d05e2f333a1d2376aee333687b3c6cb4
MD5 6e2b4cde6f1fa4c3043072883fafd1d0
SHA1 f4adab6ad68475179bc2efff8a61bb659a959e47
SHA512 0477fa18883f177e301ce5ea1db01b0d99ac24307c7944ac0c7b4a5a2ab172458390046ab11a8a8a967355ed350906dbc7bb3c87b856b2f153eee0b4a11d969c
SSDEEP 192:VoodiWunhBGoSfIhp1iJYvZXMHiWunhBGXcofbmPCdP7j+J8MfWtrod:VoodXcBl31U8MHXcBecofwUPfYWUd
MD5 SHA1 SHA512 SSDEEP

Submit Download

DevLib.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B755B07\DevLib.dll
Size 296KB
SHA256 e45c76469790518202dbc2604e8d08ef1c484eac140897587287abee4f69bfa1
MD5 722451f2f61d2539a6a7d9c00ab34cab
SHA1 f27462048194205e038377a2acb0ec6c7ebc9416
SHA512 6a1dc187280ac0cfa2b335ec774ab22cffb4e8f45cea0b6af04f33587c00b645de04f2b7979fe0c92da67133cfe13a4110883a21318abd241a156b7cc1193fac
SSDEEP 3072:IX3AZ/w7Vq+AiDjtO7qRAbdauZVzlCM+E35fw+4ZswFlbuVbjUI1byXwVygtSmaZ:3/ib9hO7qRALIvE31t4ZDFlbkUcPYekl
MD5 SHA1 SHA512 SSDEEP

Submit Download

GenericSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B755B07\GenericSetup.exe
Size 63KB
SHA256 970eb68e2918579ff7d38561342c5101cb0ee195d2dc92bf917b5e411e1e6070
MD5 412fd76263cfbd6bb9d09a432788f677
SHA1 7f026fad4c65a493ca7bfe76427b59f1788ec693
SHA512 5c721c42d281dbab1cb3f3b058c4d55b79902f8a5c939d0368a8fcd8eb8c4481d0eb9cfc34d672f95b87d24edf5c73fb2ff23a306a5dd4e5a0722f74f8cd3df2
SSDEEP 768:3AE+/58613Bwtxw0w3zeG3DSG332vUkRxitYcFroo6K1n+0/NbJ:3AV/58Aoat3DZ3QUkzOrool1R/
MD5 SHA1 SHA512 SSDEEP

Submit Download

GenericSetup.exe.config

Path C:\Users\Admin\AppData\Local\Temp\7zS0B755B07\GenericSetup.exe.config
Size 1KB
SHA256 b95626271a6815b38ede37ea8e2e9ae130ca16a51d14dc6f2349e36b010d44c6
MD5 2b3e7574b3daa725c93d5639945b2dd4
SHA1 528cce0fe1441512450af50b51f6da50b1e4f47e
SHA512 22ca92112d718a979e68820cb8088139adf82fc159dbf408bb8920dfe33cddeca1f7cea5c3d3a29ec68fe03d7497bfa9c818090e0645e75a89e8c2846fd4e28e
MD5 SHA1 SHA512

Submit Download

GenericSetup.exe.config

Path C:\Users\Admin\AppData\Local\Temp\7zS0B755B07\GenericSetup.exe.config
Size 1KB
SHA256 5c3999929532aa94d5531bbc35b9257d28037333d40b66889d222c0b96b12cea
MD5 859a06f51df4da6aadd6c6cd360f6da3
SHA1 48a68ecdf4e61cbd9ee620049dd013c4b2c03eee
SHA512 2da096cf40252b48123d853c0517a7036b4f0de9d010dcacc7ef057c25b54cd26cbdb22aba0a1ada5815d72ac1f80cd58b0dbc0ff063c92ee7b71f1ca41ef033
MD5 SHA1 SHA512

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B755B07\installer.exe
Size 1.5MB
SHA256 67f4625cf7b08dbb8276d91542507c06489dc1b6ef32b68d4c4bea1c27dc3756
MD5 5e1f66b215cc6dadbb4a1e0d9c02babd
SHA1 bfe54a6febb4008ad20bde41e90e98f84ca851e8
SHA512 e7f03c913049391f138e9f3a4fb8baa0c397422b7407104d35cb4e2ea2b37918f6834d6fc6c9e6a793f5f616ef6a6a01aeea9443c4bf410ef91a4db115c48377
SSDEEP 49152:Pcyczrbk6H/TNifx4KZsv6nAKF6YmmHgBl5cwZ0Jyyi+E+6TTm:Pc5/vh2NmmAL5CJv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2300-35-0x00007FFE575B3000-0x00007FFE575B5000-memory.dmp

Download

memory/2300-38-0x0000000002720000-0x0000000002770000-memory.dmp

Download

memory/2300-36-0x0000000000510000-0x0000000000524000-memory.dmp

Download

memory/2300-44-0x00007FFE575B0000-0x00007FFE58071000-memory.dmp

Download

memory/2300-45-0x00007FFE575B0000-0x00007FFE58071000-memory.dmp

Download