Overview

overview

7

Static

static

3

setup.exe

windows7-x64

7

setup.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

ActiveStar...xe.chm

windows7-x64

1

ActiveStar...xe.chm

windows10-2004-x64

1

ActiveStar...xe.exe

windows7-x64

6

ActiveStar...xe.exe

windows10-2004-x64

1

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01/07/2024, 19:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup.exe

  • Size

    754KB

  • MD5

    374cb3a845b0d0e7ae2ddb359b613552

  • SHA1

    459be1616ebc4b0466a7bb75df09480a1b77f4a7

  • SHA256

    483829d44a5e055c9dd037dbf10ab1f60977aa1cdad2b3555f16b4e0d48ef0be

  • SHA512

    f2925f2ffa4ddf9b07e69b9961b51af7e5ab101f9a677462585efc9ee3e6dc963d3135da18c69a0368fa845d6cfef0bf28fbc64707672dce430e77095873b4ba

  • SSDEEP

    12288:g+FslaBKQXvgEyl9WBIW58qinF5a5wHz9pDeRzHv8NApUECw2y8jJPPhG:dFsl6KQIW5+Pa4ptwbv8NYUJNPPhG

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsi1E3B.tmp\ioSpecial.ini
    Filesize

    718B

    MD5

    09f8489db4a052f13518c65105df4095

    SHA1

    c8a224504bc9e992a0c9da31b15f6aceec3a60c7

    SHA256

    43d3f41773c1880ac7082ebdbe5af50cb1838f79285e9df35ad1858e270a5602

    SHA512

    a2fc9d0d49ef113fff63805fb4c6402d15964830f0b77ec01d59bb7ce9c6abe51e45491ee789ba2ddd9db2bcb24646e3e98bbb7b29112b46e83c220ead57e0bd

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsi1E3B.tmp\InstallOptions.dll
    Filesize

    12KB

    MD5

    9aff00ec14e6cb71a13451011c580077

    SHA1

    5972140e4a0addb9eac685fe6037da7479f23ecf

    SHA256

    cc8145683ad8fd77bd5cca193e84188e40d6d03a0a0d1d00e2bdbef91be96bb3

    SHA512

    311abd4e9927c1424d794ba401f3935ad3b108a2124e58e0d29aa946514c7a1d62b9b08b013699f4f90796bdfb6c07211daddbb521c1d20ccee771f6ea43b110

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsi1E3B.tmp\LangDLL.dll
    Filesize

    5KB

    MD5

    2c3c8976d729d28478a789217a882291

    SHA1

    10c18b23fac957419547ef0f8ec3bc1b10e91e79

    SHA256

    799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef

    SHA512

    749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213

    Download Submit