Analysis

  • max time kernel
    5s
  • max time network
    4s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/09/2024, 12:33

General

  • Target

    Setup.exe

  • Size

    2.7MB

  • MD5

    870feaab725b148208dd12ffabe33f9d

  • SHA1

    9f3651ad5725848c880c24f8e749205a7e1e78c1

  • SHA256

    bbf7154f14d736f0c8491fb9fb44d2f179cdb02d34ab54c04466fa0702ea7d55

  • SHA512

    5bea301f85e6a55fd5730793b960442bc4dab92d0bf47e4e55c5490448a4a22ed6d0feb1dbe9d56d6b6ff8d06f163381807f83f467621f527bc6521857fc8e1a

  • SSDEEP

    49152:C11fbWXfBeBqTww8Gkfoa0yeL8zj9JLF+lP/MatsfHVnZbhG3EVsMI62Pseaj/1n:QbWkuwwjkULhlPUatsfBxhsE

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Users\Admin\AppData\Roaming\AEO\LTLIAVKLQCXZEQUPIG\StrCmp.exe
      C:\Users\Admin\AppData\Roaming\AEO\LTLIAVKLQCXZEQUPIG\StrCmp.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3512
    • C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\AEO\LTLIAVKLQCXZEQUPIG\StrCmp.exe

    Filesize

    47KB

    MD5

    916d7425a559aaa77f640710a65f9182

    SHA1

    23d25052aef9ba71ddeef7cfa86ee43d5ba1ea13

    SHA256

    118de01fb498e81eab4ade980a621af43b52265a9fcbae5dedc492cdf8889f35

    SHA512

    d0c260a0347441b4e263da52feb43412df217c207eba594d59c10ee36e47e1a098b82ce633851c16096b22f4a4a6f8282bdd23d149e337439fe63a77ec7343bc

  • memory/4568-0-0x00000000742A0000-0x000000007441B000-memory.dmp

    Filesize

    1.5MB

  • memory/4568-1-0x00007FF84C5F0000-0x00007FF84C7E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4568-5-0x00000000742B3000-0x00000000742B4000-memory.dmp

    Filesize

    4KB

  • memory/4568-8-0x00000000742A0000-0x000000007441B000-memory.dmp

    Filesize

    1.5MB

  • memory/4568-11-0x00000000742A0000-0x000000007441B000-memory.dmp

    Filesize

    1.5MB

  • memory/4568-15-0x00000000742A0000-0x000000007441B000-memory.dmp

    Filesize

    1.5MB