5834f6ae3522131494c225a93c30173430be80b5c144519b265395c54f35172b

Analysis

max time kernel
1507s
max time network
1494s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11/08/2024, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setuploopbe1.exe
Size 992KB
Sample240811-eppqqsyckg
SHA256 0958b39c23e02f86ba63f520cfc333842e3f7c31e197416c12f2718756ecb9be
MD5 143a3ec92e603a8eb863bef2d6f4da12
SHA1 fc0a87961f1fa5d645ea63689b0e23b491092891
SHA512 49ce58b19b86f9d2062feeed62f15c87214a5324977ab94c3421add26f79d48a29e0d590266c25c8acf01bbcf369af6bc27b1e749e0761726210724d695a2116
SSDEEP 24576:H1FFxG1QXI0iWkKZnj5v747E2As7mb2uC4OS:lxGW4SvcoPgIC4L
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2156	setuploopbe1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setuploopbe1.exe

C:\Users\Admin\AppData\Local\Temp\setuploopbe1.exe
"C:\Users\Admin\AppData\Local\Temp\setuploopbe1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nskAC30.tmp\InstallOptions.dll
Size 14KB
SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nskAC30.tmp\ioSpecial.ini
Size 724B
SHA256 f2928f8ac715d34c3ab02784182b04d56fb6d692707b51a2d1ced635c8775ee0
MD5 1b27945fcd5b3ad6e0e196f250babad0
SHA1 b914955b3809d5c1e0a05942b81e700dc1800bdc
SHA512 4da00ef985586455c82524a4d4b8de8b826425c49b0780ca739e5ecccac69f2dea9d08befbdb0b95db63e0c3fe087426d8ee4210745c0650173c8bc250badc79
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nskAC30.tmp\ioSpecial.ini
Size 763B
SHA256 437663ffccd8304613bd28402790373c08d2bac77b40002a1714ac36d830abfa
MD5 412f9a1c0bb2324f34f949971d765a98
SHA1 29561c7c2339789f6f9843ffcd3ad5b89a6b52f2
SHA512 51ea092fac8f772ca546511cad9722ab9d55801f51fcf1a5158327c906848d6fbb354143746cfddb1d61929ddfa8fbaf58093219ec50a399c86e115eb016f77b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads