Overview
overview
10Static
static
10_Getintopc...64.rar
windows11-21h2-x64
3Password 123.txt
windows11-21h2-x64
3Sausage.Fa...60.sfv
windows11-21h2-x64
3Sausage.Fa...up.exe
windows11-21h2-x64
10$PLUGINSDI...gm.ogg
windows11-21h2-x64
3$PLUGINSDI...in.skf
windows11-21h2-x64
3$PLUGINSDI...al.ini
windows11-21h2-x64
3$PLUGINSDI...rd.bmp
windows11-21h2-x64
3$PLUGINSDI...sh.bmp
windows11-21h2-x64
Resource/1.bmp
windows11-21h2-x64
3Resource/10.bmp
windows11-21h2-x64
3Resource/11.bmp
windows11-21h2-x64
3Resource/12.bmp
windows11-21h2-x64
3Resource/13.bmp
windows11-21h2-x64
3Resource/14.bmp
windows11-21h2-x64
3Resource/15.bmp
windows11-21h2-x64
3Resource/16.bmp
windows11-21h2-x64
3Resource/2.bmp
windows11-21h2-x64
3Resource/3.bmp
windows11-21h2-x64
3Resource/4.bmp
windows11-21h2-x64
3Resource/5.bmp
windows11-21h2-x64
3Resource/6.bmp
windows11-21h2-x64
3Resource/7.bmp
windows11-21h2-x64
3Resource/8.bmp
windows11-21h2-x64
3Resource/9.bmp
windows11-21h2-x64
3Resource/AboutBox.bmp
windows11-21h2-x64
3Resource/B...nd.bmp
windows11-21h2-x64
3Resource/S...32.dll
windows11-21h2-x64
3Resource/S...64.dll
windows11-21h2-x64
1Sausage Fa...64.dll
windows11-21h2-x64
1Sausage Fattener.dll
windows11-21h2-x64
1uninstall.exe
windows11-21h2-x64
7Analysis
-
max time kernel
291s -
max time network
194s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-07-2024 10:48
Behavioral task
behavioral1
Sample
_Getintopc.com_Sausage.Fattener.VST.v1.0.x86.x64.rar
Resource
win11-20240709-en
Behavioral task
behavioral2
Sample
Password 123.txt
Resource
win11-20240709-en
Behavioral task
behavioral3
Sample
Sausage.Fattener.VST.v1.0.x86.x64/Sausage.Fattener.VST.v1.0.x86.x64/asgn1160.sfv
Resource
win11-20240709-en
Behavioral task
behavioral4
Sample
Sausage.Fattener.VST.v1.0.x86.x64/Sausage.Fattener.VST.v1.0.x86.x64/setup.exe
Resource
win11-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/dat_bgm.ogg
Resource
win11-20240709-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/dat_skin.skf
Resource
win11-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win11-20240709-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/splash.bmp
Resource
win11-20240709-en
Behavioral task
behavioral10
Sample
Resource/1.bmp
Resource
win11-20240709-en
Behavioral task
behavioral11
Sample
Resource/10.bmp
Resource
win11-20240709-en
Behavioral task
behavioral12
Sample
Resource/11.bmp
Resource
win11-20240709-en
Behavioral task
behavioral13
Sample
Resource/12.bmp
Resource
win11-20240709-en
Behavioral task
behavioral14
Sample
Resource/13.bmp
Resource
win11-20240709-en
Behavioral task
behavioral15
Sample
Resource/14.bmp
Resource
win11-20240709-en
Behavioral task
behavioral16
Sample
Resource/15.bmp
Resource
win11-20240709-en
Behavioral task
behavioral17
Sample
Resource/16.bmp
Resource
win11-20240709-en
Behavioral task
behavioral18
Sample
Resource/2.bmp
Resource
win11-20240709-en
Behavioral task
behavioral19
Sample
Resource/3.bmp
Resource
win11-20240709-en
Behavioral task
behavioral20
Sample
Resource/4.bmp
Resource
win11-20240709-en
Behavioral task
behavioral21
Sample
Resource/5.bmp
Resource
win11-20240709-en
Behavioral task
behavioral22
Sample
Resource/6.bmp
Resource
win11-20240709-en
Behavioral task
behavioral23
Sample
Resource/7.bmp
Resource
win11-20240709-en
Behavioral task
behavioral24
Sample
Resource/8.bmp
Resource
win11-20240709-en
Behavioral task
behavioral25
Sample
Resource/9.bmp
Resource
win11-20240709-en
Behavioral task
behavioral26
Sample
Resource/AboutBox.bmp
Resource
win11-20240709-en
Behavioral task
behavioral27
Sample
Resource/Background.bmp
Resource
win11-20240709-en
Behavioral task
behavioral28
Sample
Resource/Sausage Fattener 32.dll
Resource
win11-20240709-en
Behavioral task
behavioral29
Sample
Resource/Sausage Fattener 64.dll
Resource
win11-20240709-en
Behavioral task
behavioral30
Sample
Sausage Fattener x64.dll
Resource
win11-20240709-en
Behavioral task
behavioral31
Sample
Sausage Fattener.dll
Resource
win11-20240709-en
Behavioral task
behavioral32
Sample
uninstall.exe
Resource
win11-20240709-en
General
-
Target
Sausage.Fattener.VST.v1.0.x86.x64/Sausage.Fattener.VST.v1.0.x86.x64/setup.exe
-
Size
3.9MB
-
MD5
81e69b29c4c09391a12b665e7661f48e
-
SHA1
b103b694d12544c9db444badd9e2263d219698b1
-
SHA256
81e45c1e6d6a718624159e116e6daa8c1547f39bef7f56163303e7eca8abfae1
-
SHA512
5476b9fa6967aefcb73793c965224c93d2ab46268830fcb71c69bc864e22e0cb92512959fe7a728ee77c2bde00e3ce9eda64d015ff1ef34273292707680c0042
-
SSDEEP
98304:QhVVJqioKMFh1qKsbZcMgsGwNmlCNE4CJgcMyfQP/4:QhV1pMzHQCMFGImHgcM54
Malware Config
Signatures
-
Detects Strela Stealer payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\nsz8406.tmp\NSIS_SkinCrafter_Plugin.dll family_strela behavioral4/memory/632-33-0x0000000004850000-0x0000000004E1D000-memory.dmp family_strela -
Loads dropped DLL 14 IoCs
Processes:
setup.exepid process 632 setup.exe 632 setup.exe 632 setup.exe 632 setup.exe 632 setup.exe 632 setup.exe 632 setup.exe 632 setup.exe 632 setup.exe 632 setup.exe 632 setup.exe 632 setup.exe 632 setup.exe 632 setup.exe -
Drops file in System32 directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Windows\SysWOW64\msvcr71.dll setup.exe File created C:\Windows\SysWOW64\mfc71.dll setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
setup.exepid process 632 setup.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1844 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1844 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
setup.exepid process 632 setup.exe 632 setup.exe 632 setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sausage.Fattener.VST.v1.0.x86.x64\Sausage.Fattener.VST.v1.0.x86.x64\setup.exe"C:\Users\Admin\AppData\Local\Temp\Sausage.Fattener.VST.v1.0.x86.x64\Sausage.Fattener.VST.v1.0.x86.x64\setup.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:632
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004AC 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
PID:1844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD513cc92f90a299f5b2b2f795d0d2e47dc
SHA1aa69ead8520876d232c6ed96021a4825e79f542f
SHA256eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb
SHA512ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3
-
Filesize
101KB
MD5a8af308ff01b4477657955fbf0cc8408
SHA10794c059f0326e4a71be8a3ee4ac17a657d90d88
SHA25614a38f56be50a3829eb1eda2a908da2de5913f81d5cb01d8b668593d0fc36594
SHA5129e221967db95d4b86bf311891193dfd1515806aa0d43198d3bc26a17d77f06f212ab9dba1ca8575f50d224380e8b109529faccf2f56daac834da83a83677a0fd
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
Filesize
5.8MB
MD5028251654a4d65509aa8ccb5f2ee284a
SHA14a4ad468a86df6b903002be4f8919017fea0c152
SHA2568b25cf3f7aa82fadccb2ce615ce0e40c5a8a3ea7bc51180a92173ee113a0ccfe
SHA512f252670bca0da9e8e2c519a6ef4ad6dd0c4e548aeb7566693a7d203e73e63345fc58683072020ef771d836429bed1d7b4fdf105aa3e62a969e9c8d39556e1d2d
-
Filesize
792KB
MD58fea8fd177034b52e6a5886fb5e780bd
SHA199f511388a2420d53b8406baed48ba550842eaad
SHA256546dddc7a31609b5bc3dc8ecef6f6782b77613853c54171fc32314c08a69e8de
SHA5125d82a3b9cf9d69049e6278a6d835b8a9a386c97ae9a69cf658675b0a8751a344d0da1ee704e9bb9023dab7cd77fdca684bdc90837960b583eef0bb4324498696
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
749B
MD52097b954c0c7ab9bb2d056ec161ff084
SHA17a5dbf0c79fafe5ed1509f3c912cd1d1a92f19c4
SHA256e7126a7702960943cdb09b2119eb771363e6388a274f5e64451964e56b9c9a3a
SHA512296579b829dc87c419a8abf72d92c6af11d1abc86a902086dc877a18b1f4814286661f11d68ce12d8565ae3e924193ac6676ce36bc0d88c8349341bdeace11f2
-
Filesize
1.0MB
MD51fd3f9722119bdf7b8cff0ecd1e84ea6
SHA19a4faa258b375e173feaca91a8bd920baf1091eb
SHA256385ea2a454172e3f9b1b18778d4d29318a12be9f0c0c0602db72e2cce136e823
SHA512109d7a80a5b10548200d05ab3d7deb9dc2ae8e40d84b468184895eb462211078ecdcb11f01eb50c91c65a924f8e592cd63b78e402dcaea144ff89c11f2ab07d6
-
Filesize
340KB
MD5ca2f560921b7b8be1cf555a5a18d54c3
SHA1432dbcf54b6f1142058b413a9d52668a2bde011d
SHA256c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb
SHA51223e0bdd9458a5a8e0f9bbcb7f6ce4f87fcc9e47c1ee15f964c17ff9fe8d0f82dd3a0f90263daaf1ee87fad4a238aa0ee92a16b3e2c67f47c84d575768edba43e