Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 16:11
Behavioral task
behavioral1
Sample
cl_pg_installer.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
cl_pg_installer.exe
Resource
win10v2004-20240508-en
General
-
Target
cl_pg_installer.exe
-
Size
11.8MB
-
MD5
bae58fe42215baaef1061348ca9251f5
-
SHA1
63207714e323f57183ec633e9f4502eb6834249d
-
SHA256
072810611923fa8f1c046c96d626393223a5e4c2a6741f700352d75282b44d22
-
SHA512
999193718ac3993a5df6463d70a06af4bd9dfcc1cc7c0279c988f1a06a8895b9581ccad8720a18e7be2d463f53f82e6f7b8ab174431000947b528ca14af9f667
-
SSDEEP
196608:8KNJm3AqWBJHcsgH++L2Vmd6+DgTNfwZHYYilkSEF/U71e8PmWvMV7A:F/m3pWBJHUe+L2Vmd6mgBkq1MN8P1M2
Malware Config
Signatures
-
Loads dropped DLL 64 IoCs
Processes:
cl_pg_installer.execl_pg_installer.execl_pg_installer.exepid Process 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 1092 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2168 cl_pg_installer.exe 2444 cl_pg_installer.exe 2444 cl_pg_installer.exe 2444 cl_pg_installer.exe 2444 cl_pg_installer.exe 2444 cl_pg_installer.exe 2444 cl_pg_installer.exe 2444 cl_pg_installer.exe 2444 cl_pg_installer.exe 2444 cl_pg_installer.exe 2444 cl_pg_installer.exe 2444 cl_pg_installer.exe 2444 cl_pg_installer.exe 2444 cl_pg_installer.exe 2444 cl_pg_installer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cl_pg_installer.execl_pg_installer.execl_pg_installer.exedescription pid Process procid_target PID 3856 wrote to memory of 1092 3856 cl_pg_installer.exe 85 PID 3856 wrote to memory of 1092 3856 cl_pg_installer.exe 85 PID 2716 wrote to memory of 2168 2716 cl_pg_installer.exe 103 PID 2716 wrote to memory of 2168 2716 cl_pg_installer.exe 103 PID 5056 wrote to memory of 2444 5056 cl_pg_installer.exe 106 PID 5056 wrote to memory of 2444 5056 cl_pg_installer.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\cl_pg_installer.exe"C:\Users\Admin\AppData\Local\Temp\cl_pg_installer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\cl_pg_installer.exe"C:\Users\Admin\AppData\Local\Temp\cl_pg_installer.exe"2⤵
- Loads dropped DLL
PID:1092
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\cl_pg_installer.exe"C:\Users\Admin\AppData\Local\Temp\cl_pg_installer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\cl_pg_installer.exe"C:\Users\Admin\AppData\Local\Temp\cl_pg_installer.exe"2⤵
- Loads dropped DLL
PID:2168
-
-
C:\Users\Admin\AppData\Local\Temp\cl_pg_installer.exe"C:\Users\Admin\AppData\Local\Temp\cl_pg_installer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\cl_pg_installer.exe"C:\Users\Admin\AppData\Local\Temp\cl_pg_installer.exe"2⤵
- Loads dropped DLL
PID:2444
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
570KB
MD5db9ef68242779edfea04d56f6ea6f86f
SHA1434b1f316b4aeaf5821570a8d93f1af046aa0038
SHA25687c2762bacaaf45c43b33dc325a86eae29ea9801daeddf597d212761330f6829
SHA512443ad7d7205ed0183982b0237ab67fe545c1b450388ca91013bdc341d10bea4f8eab197d9f5fd5e67808c1e56e0c487831e7f845c60c74a6d7f3896f0893dfcd
-
Filesize
95KB
MD5f34eb034aa4a9735218686590cba2e8b
SHA12bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA2569d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
-
Filesize
36KB
MD5135359d350f72ad4bf716b764d39e749
SHA12e59d9bbcce356f0fece56c9c4917a5cacec63d7
SHA25634048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
SHA512cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba
-
Filesize
861KB
MD56d44fd95c62c6415999ebc01af40574b
SHA1a5aee5e107d883d1490257c9702913c12b49b22a
SHA25658bacb135729a70102356c2d110651f1735bf40a602858941e13bdeabfacab4a
SHA51259b6c07079f979ad4a27ec394eab3fdd2d2d15d106544246fe38f4eb1c9e12672f11d4a8efb5a2a508690ce2677edfac85eb793e2f6a5f8781b258c421119ff3
-
Filesize
78KB
MD5d61719bf7f3d7cdebdf6c846c32ddaca
SHA1eda22e90e602c260834303bdf7a3c77ab38477d0
SHA25631dd9bfb64b1bee8faf925296028e2af907e6d933a83ddc570ebc82d11c43cfb
SHA512e6c7eab95c18921439f63a30f76313d8380e66bd715afc44a89d386ae4e80c980c2632c170a445bad7446ee5f2c3ee233ccc7333757358340d551e664204e21f
-
Filesize
117KB
MD53fc444a146f7d667169dcb4f48760f49
SHA1350a1300abc33aa7ca077daba5a883878a3bca19
SHA256b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68
SHA5121609f792583c6293abddf7f7376ffa0d33a7a895de4d8b2ecebaede74e8850b225b3bf0998b056e40e4ebffb5c97babccf52d3184b2b05072c0dbb5dcb1866f8
-
Filesize
242KB
MD58a2530a8d7e3b443d2a9409923eb1cba
SHA1cfa173219983c0c14d16f3fd21ea02c4dbb6c5bf
SHA2564f1ecc777c30df39cd70600cd0c9dc411adb622af86287b612f78be2a23b352c
SHA512310831ce8bd56b0299536c2059748207d774ac965001b394a16e2dfeeb532be0362e0810f2a1f10dcffffdb0f523a5c592cb3f9bfe56fa766a4c409a2a052388
-
Filesize
60KB
MD50d75220cf4691af4f97ebcbd9a481c62
SHA1dadc3d5476c83668a715750ed80176dbbb536ec7
SHA2569da79abfed52c7432a25a513f14134f3782c73ec7142e2d90223610eaef54303
SHA512c00bd7a768e2eef7956d05f10330f3669b279866221085f9e9b97c4e553bb44356d041e29fd4337142ccbdf4e200769d69a235c1c5ddeb6fc64d537629eac112
-
Filesize
151KB
MD5afff5db126034438405debadb4b38f08
SHA1fad8b25d9fe1c814ed307cdfddb5cd6fe778d364
SHA25675d450e973cd1ccbd0f9a35ba0d7e6d644125eb311cc432bb424a299d9a52ee0
SHA5123334d2ad9811e3be70b5a9fd84bc725c717a3ac59e2fd87e178cb39ac9172db7f9ec793011c4e613a89773b4f2425be66d44a21145a9051bed35f55a483759cc
-
Filesize
27KB
MD5c8a1f1dc297b6dd10c5f7bc64f907d38
SHA1be0913621e5ae8b04dd0c440ee3907da9cf6eb72
SHA256827a07b27121200ed9fb2e9efd13ccbf57ca7d32d9d9d1619f1c303fb4d607b7
SHA512e5f07935248f8d57b1f61fe5de2105b1555c354dd8dd98f0cff21b08caba17b66272a093c185ca025edb503690ba81d5fa8b7443805a07338b25063e2f7ea1b1
-
Filesize
74KB
MD5f59ddb8b1eeac111d6a003f60e45b389
SHA1e4e411a10c0ad4896f8b8153b826214ed8fe3caa
SHA2569558dda6a3f6ad0c3091d643e2d3bf5bf20535904f691d2bdb2ce78edf46c2da
SHA512873c6841ebf38b217465f1ead02b46a8823ef1de67d6608701e30faf5024ed00ab3c4cc4aa8c4836552ecdb16c7470fe965cf76f26ee88615746d456ff6a2bcf
-
Filesize
153KB
MD580f2475d92ad805439d92cba6e657215
SHA120aa5f43ca83b3ff07e38b00d5fbd0cf3d7dbbab
SHA25641278e309382c79356c1a4daf6dbb5819441d0c6e64981d031cda077bb6f1f79
SHA512618cd6ca973a0b04159a7c83f1f0cda5db126a807982983fea68f343c21e606a3cdb60b95a2b07f4d9379149d844755b9767fea0a64dd1d4451ab894a1f865b5
-
Filesize
1.0MB
MD559465b6baee977e8914356a90287c3d0
SHA1252a47d80a1cc308d26be4208706146f05172a55
SHA256fcc98ffcf62886fcdc9b5808faa8b8374a0b37ac42589f6a9124a70606ba1fd9
SHA5125367d2553eba9364f2117a63bbbb588d100336ece9045f034ac6b21a9d39ec790f8f6721eb5ffb49037f59f25f3b77d73dba0cb5fea9aa44f12863d2210b41f7
-
Filesize
268KB
MD559a15f9a93dcdaa5bfca246b84fa936a
SHA17f295ea74fc7ed0af0e92be08071fb0b76c8509e
SHA2562c11c3ce08ffc40d390319c72bc10d4f908e9c634494d65ed2cbc550731fd524
SHA512746157a0fcedc67120c2a194a759fa8d8e1f84837e740f379566f260e41aa96b8d4ea18e967e3d1aa1d65d5de30453446d8a8c37c636c08c6a3741387483a7d7
-
Filesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
Filesize
4.2MB
MD5e9c0fbc99d19eeedad137557f4a0ab21
SHA18945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf
SHA2565783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5
SHA51274e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b
-
Filesize
673KB
MD5020b1a47ce0b55ac69a023ed4b62e3f9
SHA1aa2a0e793f97ca60a38e92c01825a22936628038
SHA256863a72a5c93eebaa223834bc6482e5465379a095a3a3b34b0ad44dc7b3666112
SHA512b131e07de24d90a3c35c6fa2957b4fe72d62b1434c3941ad5140fb1323aacba0ec41732dac4f524dc2f492b98868b54adc97b4200aa03ff2ba17dd60baea5a70
-
Filesize
143KB
MD5bd1ee0e25a364323faa252eee25081b5
SHA17dea28e7588142d395f6b8d61c8b46104ff9f090
SHA25655969e688ad11361b22a5cfee339645f243c3505d2963f0917ac05c91c2d6814
SHA512d9456b7b45151614c6587cee54d17261a849e7950049c78f2948d93a9c7446b682e553e2d8d094c91926dd9cbaa2499b1687a9128aec38b969e95e43657c7a54
-
Filesize
26KB
MD5994a6348f53ceea82b540e2a35ca1312
SHA18d764190ed81fd29b554122c8d3ae6bf857e6e29
SHA256149427a8d58373351955ee01a1d35b5ab7e4c6ac1a312daa9ba8c72b7e5ac8a4
SHA512b3dfb4672f439fa43e29e5b1ababca74f6d53ea4bad39dfe91f59382e23dbb2a3aea2add544892e3fcd83e3c5357ee7f09fe8ab828571876f68d76f1b1fcee2f
-
Filesize
43KB
MD55984cb75a12c78927392d33300418ed4
SHA18c56104b0261746cb025d2cbf5fe70fecb18e915
SHA25638060fd9230e9f238ec1fec51a6a2459c7554deb43387f07a24e257a9b8e162e
SHA51267dd5922875c4971d68dbbb855ee85f024a6fb4d246d6d9712e9aaa895293c98d679eca713bd956d8224a115413dfcf8eea23e733b2db318948db4f2bc5bd1fc
-
Filesize
987KB
MD5d40325e6c994228a3403f8ba8f24601f
SHA16266b5dc2001ffd75da3588dd7c43027a706589d
SHA256a2ab58e44828009f6dafe54dd5ed57edfa6b09641e3c8eaa473b37e5b0e2b862
SHA51259e712713d6492fa1b002da34bc9db82a85e19d13b694b77b57db1030681432c41705d56e9f75031ed9522d43a344d1475c745af7c8c92f70f7fc78e8b8895f9
-
Filesize
1.1MB
MD5c01a5ce36dd1c822749d8ade8a5e68ca
SHA1a021d11e1eb7a63078cbc3d3e3360d6f7e120976
SHA2560f27f26d1faa4f76d4b9d79ad572a3d4f3bbe8020e2208d2f3b9046e815b578a
SHA5123d4e70a946f69633072a913fe86bada436d0c28aca322203aa5ec9d0d7ae111129516d7adb3fdeef6b1d30b50c86c1de2c23a1bc9fba388474b9d9131c1e5d38
-
Filesize
136KB
MD5fc7b3937aa735000ef549519425ce2c9
SHA1e51a78b7795446a10ed10bdcab0d924a6073278d
SHA256a6949ead059c6248969da1007ea7807dcf69a4148c51ea3bc99c15ee0bc4d308
SHA5128840ff267bf216a0be8e1cae0daac3ff01411f9afc18b1f73ba71be8ba70a873a7e198fd7d5df98f7ca8eee9a94eab196f138a7f9f37d35c51118f81860afb7d
-
Filesize
588KB
MD51f3cf8bb9c1a3a48f104cec3d384cdcb
SHA1ad759332a98d2b465087eef480f827b0ae004482
SHA2564a5e1c739e0ebf66e2d763b5ccac9e533761114eccede18e7711fd3de46dedef
SHA512d7613195b3b8d126fd2d6986af2069c068ecc2406e209a9a192f91c07ac805c15140bff70fed7eb737683f04f118633038eac3e4b4fbab1e6edde2fcc1bc5ef8