Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
01/09/2024, 14:53
General
-
Target
files-inspector-setup.exe
-
Size
17.4MB
-
MD5
2800c6f5947fbb6c9a86e5a3342a4aa0
-
SHA1
424640d4dd2fb0aefc84f178b75765f1c3865542
-
SHA256
df405d9af127b6b3e769dd6b57cffce8b96420b730c3b5a23202b2c8c27b5c06
-
SHA512
8492b327338a1d66214801b37d3cba01da092ffc9e635b29ec3fd7ee4a77d2285de123179c8c893321d934bdfa99f05b5153d753c3e9b50f1e2bb3f2052e62aa
-
SSDEEP
393216:89sXoVgt3IMk1odC1LPrEXvDZFJTnUY/WFrshQlyBdRO+IQ/s5EvUf:UsXo4aodA/w7ZvTnYRlytkeve
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\files-inspector-setup.exe"C:\Users\Admin\AppData\Local\Temp\files-inspector-setup.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KVKLV.tmp\files-inspector-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-KVKLV.tmp\files-inspector-setup.tmp" /SL5="$70150,17350508,832512,C:\Users\Admin\AppData\Local\Temp\files-inspector-setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD514fe8dc606ef6314b96a5f847d7b2b56
SHA15a99f5837c793858a7bbbceb3e7e1ebde84f44da
SHA256bdd09e3add6aea7467f72a119168a7946a4fc41d8b64d3021ee763a0937e0195
SHA512a43506d514925107ffcd8bb7ce7bebc8c7dd4c5a9df52fcb1b2b3dae6d5ff889fa03d61f496bf06e8b0a87519c71fe2667239c1f0ff5ce6f4c3ee641aa5df5bb
-
Filesize
1.0MB
MD5981eb6460fde8a6456f55811afdef266
SHA11a745e900f0ecdfd8f158c610f25cd5c38cf1d89
SHA256f05248cad953f87b0006633813dd4bf5a73b8012a2c777cd9746960bf4112de0
SHA512db9a1488f0a3b88b86a17ad65e37aa75648346cdfd2cfcc4f0c49adeb59e7c8fb7eaf30c26e670db49e4ccc6c34febb11c62fc2e80c1fe1d967f7a62b1d9e147
-
Filesize
3.0MB
MD5b0ca93ceb050a2feff0b19e65072bbb5
SHA17ebbbbe2d2acd8fd516f824338d254a33b69f08d
SHA2560e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
SHA51237242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
-
Filesize
728KB
-
Filesize
864KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
3.1MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
3.1MB