Analysis
- max time kernel
136s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
10/08/2024, 06:02
General
- Target Delta V3.61 b_26925288.exe
- Size 9.5MB
- Sample240810-grzd3asere
- SHA256 76eee256f1223082e8396611baca498542c656edd0fac5fe903e06e6cb5677e2
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 39 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Delta V3.61 b_26925288.exe"C:\Users\Admin\AppData\Local\Temp\Delta V3.61 b_26925288.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\setup26925288.exeC:\Users\Admin\AppData\Local\setup26925288.exe hhwnd=458954 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-KA1rz2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
GenericSetup.LastScreen.dll
GenericSetup.dll
H2OCommonResources.dll
H2ODAL.dll
H2OModels.dll
H2OResources.dll
H2OServices.dll
H2OUtilities.dll
H2OViewModels.dll
HtmlAgilityPack.dll
MyDownloader.Core.dll
MyDownloader.Extension.dll
Newtonsoft.Json.dll
Ninject.dll
OfferSDK.dll
OfferPage.html
SciterWrapper.dll
ServiceHide.Net.dll
ServiceHide.dll
msvcp140.dll
sciter32.dll
vcruntime140.dll
setup26925288.exe
memory/4520-170-0x0000000006B40000-0x0000000006B4A000-memory.dmp
memory/4520-171-0x00000000070C0000-0x00000000070E2000-memory.dmp
memory/4520-46-0x0000000005BE0000-0x0000000005C04000-memory.dmp
memory/4520-110-0x0000000005E20000-0x0000000005E28000-memory.dmp
memory/4520-118-0x0000000005E70000-0x0000000005E9C000-memory.dmp
memory/4520-39-0x0000000072160000-0x0000000072910000-memory.dmp
memory/4520-54-0x0000000005C40000-0x0000000005C68000-memory.dmp
memory/4520-128-0x0000000005DD0000-0x0000000005DED000-memory.dmp
memory/4520-37-0x0000000005B90000-0x0000000005BA4000-memory.dmp
memory/4520-144-0x00000000064E0000-0x00000000064F2000-memory.dmp
memory/4520-94-0x0000000005DF0000-0x0000000005E14000-memory.dmp
memory/4520-62-0x0000000005C70000-0x0000000005C9E000-memory.dmp
memory/4520-172-0x00000000070F0000-0x0000000007444000-memory.dmp
memory/4520-102-0x0000000005CC0000-0x0000000005CCA000-memory.dmp
memory/4520-165-0x0000000006BC0000-0x0000000006C4C000-memory.dmp
memory/4520-78-0x0000000005D80000-0x0000000005DB2000-memory.dmp
memory/4520-178-0x00000000074B0000-0x00000000074BC000-memory.dmp
memory/4520-181-0x0000000007A90000-0x0000000008034000-memory.dmp
memory/4520-70-0x0000000005CD0000-0x0000000005CF8000-memory.dmp
memory/4520-187-0x0000000008600000-0x0000000008BB4000-memory.dmp
memory/4520-198-0x0000000007700000-0x0000000007792000-memory.dmp
memory/4520-86-0x0000000005D40000-0x0000000005D5A000-memory.dmp
memory/4520-18-0x0000000000E50000-0x0000000001228000-memory.dmp
memory/4520-215-0x00000000061E0000-0x000000000620E000-memory.dmp
memory/4520-17-0x000000007216E000-0x000000007216F000-memory.dmp
memory/4520-243-0x000000007216E000-0x000000007216F000-memory.dmp
memory/4520-244-0x0000000072160000-0x0000000072910000-memory.dmp