Overview
overview
10Static
static
1Setup.exe
windows7-x64
1Setup.exe
windows10-2004-x64
10WebView2Loader.dll
windows7-x64
1WebView2Loader.dll
windows10-2004-x64
1config.exe
windows7-x64
1config.exe
windows10-2004-x64
3opengl64.exe
windows7-x64
1opengl64.exe
windows10-2004-x64
1updater/NvStWiz.exe
windows7-x64
3updater/NvStWiz.exe
windows10-2004-x64
3x64/trading_api64.dll
windows7-x64
1x64/trading_api64.dll
windows10-2004-x64
1x64/tradin...ts.dll
windows7-x64
1x64/tradin...ts.dll
windows10-2004-x64
1x86/api-ms...-1.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1Resubmissions
06-08-2024 11:22
240806-ng2vrs1hkf 1006-08-2024 10:55
240806-m1enxaxdmk 706-08-2024 10:51
240806-mxymls1eje 306-08-2024 10:49
240806-mw4r8sxcnj 10Analysis
-
max time kernel
110s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2024 10:49
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
WebView2Loader.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
WebView2Loader.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
config.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
config.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
opengl64.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
opengl64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
updater/NvStWiz.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
updater/NvStWiz.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
x64/trading_api64.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
x64/trading_api64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
x64/tradingnetworkingsockets.dll
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
x64/tradingnetworkingsockets.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
x86/api-ms-win-core-processthreads-l1-1-1.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
x86/api-ms-win-core-profile-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
x86/api-ms-win-core-rtlsupport-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
x86/api-ms-win-core-string-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
x86/api-ms-win-core-synch-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral20
Sample
x86/api-ms-win-core-synch-l1-2-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
x86/api-ms-win-core-sysinfo-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral22
Sample
x86/api-ms-win-core-timezone-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
x86/api-ms-win-core-util-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral24
Sample
x86/api-ms-win-crt-conio-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
x86/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral26
Sample
x86/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
x86/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral28
Sample
x86/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
x86/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral30
Sample
x86/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
x86/api-ms-win-crt-multibyte-l1-1-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral32
Sample
x86/api-ms-win-crt-private-l1-1-0.dll
Resource
win10v2004-20240802-en
General
-
Target
Setup.exe
-
Size
1.1MB
-
MD5
c047ae13fc1e25bc494b17ca10aa179e
-
SHA1
e293c7815c0eb8fbc44d60a3e9b27bd91b44b522
-
SHA256
6c30c8a2e827f48fcfc934dd34fb2cb10acb8747fd11faae085d8ad352c01fbf
-
SHA512
0cfb96d23b043bcb954cc307f85e5bbc349c0c8a0c6eaa335ea9a8fa19ce65b047f30ed0049562d40880400d4f70e3bb28975d6970f3ae4af6da1ba06e36d48c
-
SSDEEP
12288:a9hZPq27B7+x3dPC4gvgdVwTzDxsVyY4YoUwpf5kpRG6xsfJAYo2R0B5YD5sW91A:STS27B7+x3E4tdS/Dxkd4YoDfZ90gLS
Malware Config
Extracted
lumma
https://erdefendkzov.shop/api
https://chippyfroggsyhz.shop/api
https://tenntysjuxmz.shop/api
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
StrCmp.exepid process 2708 StrCmp.exe -
Loads dropped DLL 1 IoCs
Processes:
Encounter.pifpid process 4644 Encounter.pif -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Setup.exemore.comdescription pid process target process PID 1488 set thread context of 5112 1488 Setup.exe more.com PID 5112 set thread context of 4644 5112 more.com Encounter.pif -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
StrCmp.exemore.comEncounter.pifdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StrCmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language more.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Encounter.pif -
Modifies registry class 64 IoCs
Processes:
StrCmp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\Version = "2.1" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\LocalServer32 StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791} StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\Forward\ = "{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ = "cBluetoothDaemon" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\0\win32 StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\HELPDIR StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\ProgID\ = "BtDaemon.cBluetoothDaemon" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\Version = "2.1" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\TypeLib StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon\Clsid\ = "{4F7FA487-8CC1-493E-AF0A-E7A294474F25}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid32 StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "cBluetoothDaemon" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\Forward\ = "{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32 StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\Version = "2.1" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F} StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\VERSION\ = "2.1" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ = "cBluetoothDaemon" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\Version = "2.1" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid32 StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\ = "BtDaemon" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\FLAGS StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "_cBluetoothDaemon" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25} StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\ = "BtDaemon.cBluetoothDaemon" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1 StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Httpta\\QWGDXBWDXGLOLVQVHQ\\StrCmp.exe" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32 StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Httpta\\QWGDXBWDXGLOLVQVHQ\\StrCmp.exe" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\Forward StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32 StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F} StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32 StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ = "cBluetoothDaemon" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\Httpta\\QWGDXBWDXGLOLVQVHQ" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ = "__cBluetoothDaemon" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D} StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC} StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\VERSION StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC} StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "_cBluetoothDaemon" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ = "__cBluetoothDaemon" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\Forward StrCmp.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Setup.exemore.compid process 1488 Setup.exe 1488 Setup.exe 5112 more.com 5112 more.com -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
Setup.exemore.compid process 1488 Setup.exe 5112 more.com 5112 more.com -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
StrCmp.exepid process 2708 StrCmp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Setup.exemore.comdescription pid process target process PID 1488 wrote to memory of 2708 1488 Setup.exe StrCmp.exe PID 1488 wrote to memory of 2708 1488 Setup.exe StrCmp.exe PID 1488 wrote to memory of 2708 1488 Setup.exe StrCmp.exe PID 1488 wrote to memory of 5112 1488 Setup.exe more.com PID 1488 wrote to memory of 5112 1488 Setup.exe more.com PID 1488 wrote to memory of 5112 1488 Setup.exe more.com PID 1488 wrote to memory of 5112 1488 Setup.exe more.com PID 5112 wrote to memory of 4644 5112 more.com Encounter.pif PID 5112 wrote to memory of 4644 5112 more.com Encounter.pif PID 5112 wrote to memory of 4644 5112 more.com Encounter.pif PID 5112 wrote to memory of 4644 5112 more.com Encounter.pif PID 5112 wrote to memory of 4644 5112 more.com Encounter.pif
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Roaming\Httpta\QWGDXBWDXGLOLVQVHQ\StrCmp.exeC:\Users\Admin\AppData\Roaming\Httpta\QWGDXBWDXGLOLVQVHQ\StrCmp.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2708 -
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\Encounter.pifC:\Users\Admin\AppData\Local\Temp\Encounter.pif3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5d0509de5ba78cdfb67f897b06d9d184d
SHA1f3ea9fa41831739d38353167754c0bb5a9544001
SHA256a5a7183977808efbaa1ca3e55776f09bcae8f30e2aa5b0520c9cd88cd0d4997d
SHA5120cdfb02946e8450a057db69f3e4331adc2b1bffee2d6002ea2a1ba8b9964883dd71c6f5becd41c02a4a06fd84e20836348b56af3696ae21587a774ec75d9f2c5
-
Filesize
1.2MB
MD5e798e89491502a23dd6fa4b883fbdac3
SHA1336db0cf5438e003100a466688c5d8bdc6625f31
SHA25604467f190d53a02792d10425b883b7d45a807e9dce456656ed7a23217cb26820
SHA51245676f30905f770900543003d9a18803282a7f3d122e0f4aa4f2fafecc9fd25b62d9025252a52f70090180dcfb71b05aed3c9cab7878ad08f5ca49864e1a6721
-
Filesize
47KB
MD5916d7425a559aaa77f640710a65f9182
SHA123d25052aef9ba71ddeef7cfa86ee43d5ba1ea13
SHA256118de01fb498e81eab4ade980a621af43b52265a9fcbae5dedc492cdf8889f35
SHA512d0c260a0347441b4e263da52feb43412df217c207eba594d59c10ee36e47e1a098b82ce633851c16096b22f4a4a6f8282bdd23d149e337439fe63a77ec7343bc