Overview
overview
7Static
static
3##!!SetUp_...ar.exe
windows7-x64
1##!!SetUp_...ar.exe
windows10-2004-x64
1##!!SetUp_...86.dll
windows7-x64
1##!!SetUp_...86.dll
windows10-2004-x64
1##!!SetUp_...up.exe
windows7-x64
7##!!SetUp_...up.exe
windows10-2004-x64
7##!!SetUp_...ut.app
macos-10.15-amd64
4##!!SetUp_...eN.dll
windows7-x64
1##!!SetUp_...eN.dll
windows10-2004-x64
1##!!SetUp_...32.dll
windows7-x64
1##!!SetUp_...32.dll
windows10-2004-x64
1##!!SetUp_...1].exe
windows7-x64
##!!SetUp_...1].exe
windows10-2004-x64
##!!SetUp_...40.dll
windows7-x64
1##!!SetUp_...40.dll
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/Language/WinRar.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/Language/WinRar.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/MediaInfo_i386.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/MediaInfo_i386.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/Setup.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/Setup.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/butternut.app
Resource
macos-20240611-en
Behavioral task
behavioral8
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/en-US/AutoWorkplaceN.dll
Resource
win7-20240705-en
Behavioral task
behavioral9
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/en-US/AutoWorkplaceN.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral10
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/en-US/avicap32.dll
Resource
win7-20240708-en
Behavioral task
behavioral11
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/en-US/avicap32.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral12
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/fonts/chrome_[1MB]_[1].exe
Resource
win7-20240704-en
Behavioral task
behavioral13
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/fonts/chrome_[1MB]_[1].exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral14
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/vcruntime140.dll
Resource
win7-20240705-en
Behavioral task
behavioral15
Sample
##!!SetUp_2244_Pa$sW0rd$$!!/vcruntime140.dll
Resource
win10v2004-20240709-en
General
-
Target
##!!SetUp_2244_Pa$sW0rd$$!!/Setup.exe
-
Size
38.1MB
-
MD5
41e7a253862392cff9c7fe629fffd27a
-
SHA1
460593e15394f9bd18dafa4f616984746e76e989
-
SHA256
4487a7bc41c7c4e3e2b8b0e698b9a8b5a31a0ac4d6a421dcb4ea62a31e4d6cb0
-
SHA512
48f9208e6fdb09cac1a7ae41b356cfe650b38c8742a77ddd6dce838cc0063d075387716049e995c23c898447d9d0cc28371c182a5c3f3fc669a553c0a8347a24
-
SSDEEP
3072:5MvbirZEuBkR75p/3kopQVjh6MXKYgIwiwJgXLS0+Q+qxYxCn:ujir7epX8jFXHwiwMu
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2184 1408 WerFault.exe 84 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\##!!SetUp_2244_Pa$sW0rd$$!!\Setup.exe"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_2244_Pa$sW0rd$$!!\Setup.exe"1⤵
- Checks processor information in registry
PID:1408 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 10762⤵
- Program crash
PID:2184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1408 -ip 14081⤵PID:3216