b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd

Analysis

max time kernel
259s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

oalinst.exe
Size

790KB
MD5

694f54bd227916b89fc3eb1db53f0685
SHA1

21fdc367291bbef14dac27925cae698d3928eead
SHA256

b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
SHA512

55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
SSDEEP

12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\tmp560F.tmp	oalinst.exe
File created	C:\Windows\SysWOW64\wrap_oal.new	oalinst.exe
File created	C:\Windows\system32\OpenAL32.new	oalinst.exe
File opened for modification	C:\Windows\SysWOW64\tmp2A29.tmp	oalinst.exe
File opened for modification	C:\Windows\SysWOW64\tmp2A2A.tmp	oalinst.exe
File created	C:\Windows\SysWOW64\wrap_oal.new	oalinst.exe
File opened for modification	C:\Windows\SysWOW64\tmp5610.tmp	oalinst.exe
File created	C:\Windows\SysWOW64\OpenAL32.new	oalinst.exe
File created	C:\Windows\system32\wrap_oal.new	oalinst.exe
File created	C:\Windows\SysWOW64\OpenAL32.new	oalinst.exe
File created	C:\Windows\system32\OpenAL32.new	oalinst.exe
File created	C:\Windows\system32\wrap_oal.new	oalinst.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\OpenAL\oalinst.exe	oalinst.exe
File opened for modification	C:\Program Files (x86)\OpenAL\oalinst.exe	oalinst.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4916	oalinst.exe

C:\Users\Admin\AppData\Local\Temp\oalinst.exe
"C:\Users\Admin\AppData\Local\Temp\oalinst.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
PID:4628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3340

C:\Users\Admin\Desktop\oalinst.exe
"C:\Users\Admin\Desktop\oalinst.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\OpenAL32.dll

Filesize
106KB

MD5
235355a8dd26903e75d5e812ecf50e53

SHA1
8316319341a0f9054e19e4a7b21df3dc49386fee

SHA256
1797d150a2e23af4f390f5c33eb598c6f58d0454011d74941f5316add900bbdd

SHA512
5beb9343028790f993d0acb1007fd112b7e2ef6f9fbedfdb62b0140d2bbadf3b6368417ea19edb0bc8674d19418e5784fef4430ce1c329de8e83c304706d39ac

Download Submit
C:\Windows\SysWOW64\tmp2A2A.tmp

Filesize
790KB

MD5
694f54bd227916b89fc3eb1db53f0685

SHA1
21fdc367291bbef14dac27925cae698d3928eead

SHA256
b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd

SHA512
55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5

Download Submit
C:\Windows\SysWOW64\wrap_oal.new

Filesize
434KB

MD5
d494267bc169604fac5e3679b9a97fed

SHA1
c093ce5a4f7dc40f7f604945bd1facfb2c805c4b

SHA256
a4e46e6d09c4b0966824a2f6628ebf738e813672692a52a0d63d982e1030ef4f

SHA512
7cfcfb570ecfa974054b5285c7d6ad3bccf502866ea70789750c3748394cb0991d1fa6dec9c50a506dbc697953663ec2605277a4451098bb8cd6699c4e506040

Download Submit
C:\Windows\system32\OpenAL32.dll

Filesize
120KB

MD5
2ad7b4f3c8d2bb686d231edff404b7a4

SHA1
f29676b96d04bd2765925a3834d9babfdce6a0b3

SHA256
87802322c8e63555c26fe473ce234ce7099745ccb28c02766c2224c726454039

SHA512
51a6c8cfe30e34c37437e6c5f8c602aa0759b65559a82521e2dbcf8a9865b826077854acb6497df6085d67b4c66083ae5f0f192b743a4b6f77ce7b18f01bf528

Download Submit
C:\Windows\system32\wrap_oal.dll

Filesize
455KB

MD5
549347bcd4aacd63243d78e8f869dbb1

SHA1
efc00d2a7c5acfe17b8a58023826e6840aef39a6

SHA256
5379373cf3eff41cdd8c912c65e27e1bd492bd84238d19a093aa846c9b1ce909

SHA512
c6789376d05deb8c5050225c37c023055c107a72b49afddfd3f91e7e7429d38db9346e2e5d38986c2000c3828389cfbe5d74d80423a79eebd0367bcc81137cd5

Download Submit