Overview
overview
10Static
static
3Debugs/AlphaFS.dll
windows7-x64
1Debugs/AlphaFS.dll
windows10-2004-x64
1Debugs/License.dll
windows7-x64
1Debugs/License.dll
windows10-2004-x64
1Debugs/New...on.dll
windows7-x64
1Debugs/New...on.dll
windows10-2004-x64
1Debugs/Ver...le.dll
windows7-x64
1Debugs/Ver...le.dll
windows10-2004-x64
1GSLogging.dll
windows7-x64
1GSLogging.dll
windows10-2004-x64
1Libs/Extreme.Net.dll
windows7-x64
1Libs/Extreme.Net.dll
windows10-2004-x64
1Libs/Injecting.dll
windows7-x64
1Libs/Injecting.dll
windows10-2004-x64
1Libs/Parin...1].exe
windows7-x64
1Libs/Parin...1].exe
windows10-2004-x64
1Libs/libEGL.dll
windows7-x64
1Libs/libEGL.dll
windows10-2004-x64
3Libs/libgc...-1.dll
windows7-x64
3Libs/libgc...-1.dll
windows10-2004-x64
3MigrationLibrary.dll
windows7-x64
1MigrationLibrary.dll
windows10-2004-x64
1Setup.exe
windows7-x64
1Setup.exe
windows10-2004-x64
10mfc100enu.dll
windows7-x64
1mfc100enu.dll
windows10-2004-x64
1mfc100u.dll
windows7-x64
1mfc100u.dll
windows10-2004-x64
1msvcp100.dll
windows7-x64
1msvcp100.dll
windows10-2004-x64
1msvcr100.dll
windows7-x64
1msvcr100.dll
windows10-2004-x64
1Analysis
-
max time kernel
64s -
max time network
67s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 23:42
Static task
static1
Behavioral task
behavioral1
Sample
Debugs/AlphaFS.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Debugs/AlphaFS.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Debugs/License.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Debugs/License.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
Debugs/Newtonsoft.Json.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Debugs/Newtonsoft.Json.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Debugs/VersionStable.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Debugs/VersionStable.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
GSLogging.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
GSLogging.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Libs/Extreme.Net.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Libs/Extreme.Net.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Libs/Injecting.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Libs/Injecting.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
Libs/Paring_[1MB]_[1].exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Libs/Paring_[1MB]_[1].exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
Libs/libEGL.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Libs/libEGL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
Libs/libgcc_s_dw2-1.dll
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
Libs/libgcc_s_dw2-1.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
MigrationLibrary.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
MigrationLibrary.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
Setup.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Setup.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
mfc100enu.dll
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
mfc100enu.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
mfc100u.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
mfc100u.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
msvcp100.dll
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
msvcp100.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
msvcr100.dll
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
msvcr100.dll
Resource
win10v2004-20240709-en
General
-
Target
Setup.exe
-
Size
455KB
-
MD5
c544a0e2e173c94fa9069c73e7af6367
-
SHA1
1b8040c145d6cb2af6d1d9c1dc6878d51820e53b
-
SHA256
9d8547266c90cae7e2f5f5a81af27fb6bc6ade56a798b429cdb6588a89cec874
-
SHA512
f47694025fad1c67b727c9836d3663fa0f251a46e855e78e4c323beac1d82d13632e10d16e06e0d81718953ed6e06ee5e918195268ba988f3e555b432f1784a7
-
SSDEEP
3072:JrD9fI1D2oKZrGp4Lczp9+fOZveTHdHZ0Cp2Sb0Q0F:U1D2XGp4LczSOle5Zzp2Wg
Malware Config
Extracted
lumma
https://unwielldyzpwo.shop/api
https://bouncedgowp.shop/api
https://bannngwko.shop/api
https://bargainnykwo.shop/api
https://affecthorsedpo.shop/api
https://radiationnopp.shop/api
https://answerrsdo.shop/api
https://publicitttyps.shop/api
https://benchillppwo.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid Process procid_target PID 220 set thread context of 800 220 Setup.exe 85 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Setup.exemore.compid Process 220 Setup.exe 220 Setup.exe 800 more.com 800 more.com -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Setup.exemore.compid Process 220 Setup.exe 800 more.com -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Setup.exemore.comdescription pid Process procid_target PID 220 wrote to memory of 800 220 Setup.exe 85 PID 220 wrote to memory of 800 220 Setup.exe 85 PID 220 wrote to memory of 800 220 Setup.exe 85 PID 220 wrote to memory of 800 220 Setup.exe 85 PID 800 wrote to memory of 4876 800 more.com 90 PID 800 wrote to memory of 4876 800 more.com 90 PID 800 wrote to memory of 4876 800 more.com 90 PID 800 wrote to memory of 4876 800 more.com 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\SearchIndexer.exeC:\Windows\SysWOW64\SearchIndexer.exe3⤵PID:4876
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5ae5dbebf5a8ebe14cec80907b9021963
SHA1f12f075f74540372f7a644bd57ec9f140fbc424f
SHA2569d609f2557e519c61e49f0626d7ee51955912e08a1485409208cc6f322cb26af
SHA5128738f9fb65a76b069932fdd0188d09e9d27be3c3b34eb55e1835c89e1419492cd75843513ee2d6bb450e163f293d39d06620d5489d34bfc00fa873b139138420