Overview
overview
10Static
static
3archive/ResIL.dll
windows7-x64
1archive/ResIL.dll
windows10-2004-x64
3archive/libGLESv2.dll
windows7-x64
3archive/libGLESv2.dll
windows10-2004-x64
3archive/re...zA.exe
windows7-x64
1archive/re...zA.exe
windows10-2004-x64
1archive/setup.exe
windows7-x64
10archive/setup.exe
windows10-2004-x64
10archive/up...я.exe
windows7-x64
7archive/up...я.exe
windows10-2004-x64
7archive/up...я.exe
windows7-x64
7archive/up...я.exe
windows10-2004-x64
7archive/up...я.exe
windows7-x64
7archive/up...я.exe
windows10-2004-x64
7archive/up...я.exe
windows7-x64
7archive/up...я.exe
windows10-2004-x64
7archive/up...я.exe
windows7-x64
7archive/up...я.exe
windows10-2004-x64
7archive/up...5).exe
windows7-x64
1archive/up...5).exe
windows10-2004-x64
1archive/up...я.exe
windows7-x64
7archive/up...я.exe
windows10-2004-x64
7archive/up...6).exe
windows7-x64
7archive/up...6).exe
windows10-2004-x64
7archive/up...я.exe
windows7-x64
7archive/up...я.exe
windows10-2004-x64
7archive/up...7).exe
windows7-x64
7archive/up...7).exe
windows10-2004-x64
7archive/up...я.exe
windows7-x64
7archive/up...я.exe
windows10-2004-x64
7archive/up...я.exe
windows7-x64
7archive/up...я.exe
windows10-2004-x64
7Analysis
-
max time kernel
145s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 03:56
Static task
static1
Behavioral task
behavioral1
Sample
archive/ResIL.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
archive/ResIL.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
archive/libGLESv2.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
archive/libGLESv2.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
archive/res_mods/1.23.0.0/scripts/client/gui/mods/7zA.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
archive/res_mods/1.23.0.0/scripts/client/gui/mods/7zA.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
archive/setup.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
archive/setup.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
archive/update/Uninstall/unins000 — копия (10) — копия.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
archive/update/Uninstall/unins000 — копия (10) — копия.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
archive/update/Uninstall/unins000 — копия (11) — копия.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
archive/update/Uninstall/unins000 — копия (11) — копия.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
archive/update/Uninstall/unins000 — копия (12) — копия.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
archive/update/Uninstall/unins000 — копия (12) — копия.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
archive/update/Uninstall/unins000 — копия (13) — копия.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
archive/update/Uninstall/unins000 — копия (13) — копия.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
archive/update/Uninstall/unins000 — копия (2) — копия.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
archive/update/Uninstall/unins000 — копия (2) — копия.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
archive/update/Uninstall/unins000 — копия (5).exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
archive/update/Uninstall/unins000 — копия (5).exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
archive/update/Uninstall/unins000 — копия (6) — копия.exe
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
archive/update/Uninstall/unins000 — копия (6) — копия.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
archive/update/Uninstall/unins000 — копия (6).exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
archive/update/Uninstall/unins000 — копия (6).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
archive/update/Uninstall/unins000 — копия (7) — копия.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
archive/update/Uninstall/unins000 — копия (7) — копия.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral27
Sample
archive/update/Uninstall/unins000 — копия (7).exe
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
archive/update/Uninstall/unins000 — копия (7).exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral29
Sample
archive/update/Uninstall/unins000 — копия (8) — копия.exe
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
archive/update/Uninstall/unins000 — копия (8) — копия.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
archive/update/Uninstall/unins000 — копия (9) — копия.exe
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
archive/update/Uninstall/unins000 — копия (9) — копия.exe
Resource
win10v2004-20240704-en
General
-
Target
archive/update/Uninstall/unins000 — копия (11) — копия.exe
-
Size
1.5MB
-
MD5
3ab31d714c50ae078f9eaba7b2497191
-
SHA1
45c5e807e459d95618c03a6ded9debe1d70013f3
-
SHA256
4f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
-
SHA512
f89961fb914796b07da8f224317bb794f9cf0cc8b40e635823b0bb8a6713048c5b2de08e1c4e9dd4f81c6f579e3bc3551a9342ba34db9a6de1c0d6755ec140ae
-
SSDEEP
24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKMrexLxB:cIEJxCWluyZ8UbMZz
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3964 _iu14D2N.tmp -
Executes dropped EXE 1 IoCs
pid Process 3964 _iu14D2N.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3964 _iu14D2N.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3840 wrote to memory of 3964 3840 unins000 — копия (11) — копия.exe 81 PID 3840 wrote to memory of 3964 3840 unins000 — копия (11) — копия.exe 81 PID 3840 wrote to memory of 3964 3840 unins000 — копия (11) — копия.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\archive\update\Uninstall\unins000 — копия (11) — копия.exe"C:\Users\Admin\AppData\Local\Temp\archive\update\Uninstall\unins000 — копия (11) — копия.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\archive\update\Uninstall\unins000 — копия (11) — копия.exe" /FIRSTPHASEWND=$10004E2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:3964
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD53ab31d714c50ae078f9eaba7b2497191
SHA145c5e807e459d95618c03a6ded9debe1d70013f3
SHA2564f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
SHA512f89961fb914796b07da8f224317bb794f9cf0cc8b40e635823b0bb8a6713048c5b2de08e1c4e9dd4f81c6f579e3bc3551a9342ba34db9a6de1c0d6755ec140ae