5554a6526917a29f86250fcb791bc937951f80ccc18d9fc974c4fb7ecbe1d42b

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-09-2024 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cleo_redux_setup.exe
Size

6.5MB
MD5

87682f3ff5d240492ffd4d6a8fa9d700
SHA1

5c00d0eb392601b63f693b9e35d92f161b7c22f8
SHA256

5554a6526917a29f86250fcb791bc937951f80ccc18d9fc974c4fb7ecbe1d42b
SHA512

2267d6097446e9eb4317e38de4f24058b5d225c9731644d27f307f74d7ae102b2378ef4d4c42f779fe48c360f71d1cbbf076e606216c9c466efdffebba353110
SSDEEP

196608:QUGUbH3DLzhR8qKHaxB3AdGmb51l81Tu1HwTT:VPLz/8qKH8BYGejk8Hwn

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1356	cleo_redux_setup.tmp

Loads dropped DLL 1 IoCs

pid	Process
2516	cleo_redux_setup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cleo_redux_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cleo_redux_setup.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1356	2516	cleo_redux_setup.exe	30
PID 2516 wrote to memory of 1356	2516	cleo_redux_setup.exe	30
PID 2516 wrote to memory of 1356	2516	cleo_redux_setup.exe	30
PID 2516 wrote to memory of 1356	2516	cleo_redux_setup.exe	30
PID 2516 wrote to memory of 1356	2516	cleo_redux_setup.exe	30
PID 2516 wrote to memory of 1356	2516	cleo_redux_setup.exe	30
PID 2516 wrote to memory of 1356	2516	cleo_redux_setup.exe	30

C:\Users\Admin\AppData\Local\Temp\cleo_redux_setup.exe
"C:\Users\Admin\AppData\Local\Temp\cleo_redux_setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\is-NI5NK.tmp\cleo_redux_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NI5NK.tmp\cleo_redux_setup.tmp" /SL5="$400EE,5939128,1157632,C:\Users\Admin\AppData\Local\Temp\cleo_redux_setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-NI5NK.tmp\cleo_redux_setup.tmp

Filesize
3.3MB

MD5
ed3657d38e2ad38968fb4d785b90479c

SHA1
9aa054d2e754fab046177911aaba8947ff3b93c2

SHA256
cea94eaae597a41dd52c83c970b06d9fdacef4857299ff6ba72ab0259e913ab1

SHA512
a7dd05adba90f0066ecb976d6e2d5f345196f3b20684e172eb74cfe941fd85febdad00167df16168ae1b48781cb6a285f56d9e996945fb6749a0e8f783d86eab

Download Submit
memory/1356-8-0x0000000000400000-0x0000000000764000-memory.dmp

Filesize
3.4MB

Download
memory/1356-12-0x0000000000400000-0x0000000000764000-memory.dmp

Filesize
3.4MB

Download
memory/2516-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2516-0-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/2516-10-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download