Overview

overview

7

Static

static

3

obfuscator...er.exe

windows11-21h2-x64

7

$PLUGINSDI...ns.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...al.ini

windows11-21h2-x64

3

$PLUGINSDI...rd.bmp

windows11-21h2-x64

3

$R0.dll

windows11-21h2-x64

3

$R2/NSIS.L...5_.exe

windows11-21h2-x64

3

changelog.txt

windows11-21h2-x64

3

license.txt

windows11-21h2-x64

3

obfuscator...la.pdf

windows11-21h2-x64

3

obfuscator.exe

windows11-21h2-x64

3

obfuscator.ico

windows11-21h2-x64

3

readme.txt

windows11-21h2-x64

3

Analysis

  • max time kernel
    19s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/09/2024, 17:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    obfuscator-executive-x86-v5.0.25-installer.exe

  • Size

    2.1MB

  • MD5

    11ebd9213f11aefb32c33a2b4374a26d

  • SHA1

    92d3285fcad6354f3f3486a796f76b31a341bafb

  • SHA256

    9d98abb75b0c7b587d3ccf35284d022161b909351bfed0b7b0f60514cb9600d0

  • SHA512

    90456ecc6c97546b55fd1fffbf9547fc4dc3a84c838a7a02d95644c71b10d6a72cb29f0562a39e7409a911c0db34a964e83b4de9e58789df8bd955a6b028f1e7

  • SSDEEP

    49152:l/YKtc4ooTgXNkMzxqVVJt7O2vzqj1EIvWhdJGN:lgKtc4oo2B9qVVJvrY1pvWhdu

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\obfuscator-executive-x86-v5.0.25-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\obfuscator-executive-x86-v5.0.25-installer.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\Program Files (x86)\Obfuscator Executive\obfuscator.exe
      "C:\Program Files (x86)\Obfuscator Executive\obfuscator.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Obfuscator Executive\obfuscator.exe
    Filesize

    1.8MB

    MD5

    3248437118cdd909b7586a6420052a87

    SHA1

    9fd1d526ac648f70c7f724eebbedf34a8bbbb050

    SHA256

    c21f4d533e6bf34dbf403faee89f840fad87ea7c03ec08df28ce6d62703495f7

    SHA512

    75dadbc4c9b95c483f1917e320e5369515b3d209753bb3d9d5d551c514dd7d1d989fe47811ffe07adb5cd2214737637f2823897eef8487601d854718c7cbbfcd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsdDB2F.tmp\InstallOptions.dll
    Filesize

    15KB

    MD5

    d095b082b7c5ba4665d40d9c5042af6d

    SHA1

    2220277304af105ca6c56219f56f04e894b28d27

    SHA256

    b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

    SHA512

    61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsdDB2F.tmp\System.dll
    Filesize

    12KB

    MD5

    4add245d4ba34b04f213409bfe504c07

    SHA1

    ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    SHA256

    9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    SHA512

    1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsdDB2F.tmp\ioSpecial.ini
    Filesize

    1KB

    MD5

    1eb8dc1e4d8d247f9868202ae7d441ad

    SHA1

    a6eb3c6e6e437d57e0a0da239ad53b24d1daf7f5

    SHA256

    771b79dea4e04d1d6e5247a35dda8f1dfb1cbd7e5fd99f53cbbbc8f9faec7e4d

    SHA512

    73d7de733d0205ab2ee40fae21778da73529437716f0fffe2ee43cd291069aa44d88adc7f4055a021f6c5684fcff9aeefe171abebbaf07180776173fbfc044e7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsdDB2F.tmp\ioSpecial.ini
    Filesize

    1KB

    MD5

    de95a948ee9b1404e710bb3b0dbdc0d1

    SHA1

    d6210956eb8bd6aee40f2d7991881a77906a3295

    SHA256

    4fc9f002ed09f15a6690a45ec2e24ec7298883a7b032affd0b708258e281db47

    SHA512

    c8f53dc8d2c98f8fea9222431cf550364f9e19d0596e3dc976376eca6203554a02ec773a0d1e046753fc76d6ca398e58a1ea602a2f6e9778723ac82c32635991

    Download Submit

  • memory/5040-221-0x000000002B120000-0x000000002B121000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5040-222-0x000000002B4F0000-0x000000002B4F1000-memory.dmp

    Filesize

    4KB

    Download