Overview
overview
7Static
static
3disbelief-...er.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...al.ini
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows10-2004-x64
7$PLUGINSDI...rd.bmp
windows10-2004-x64
7$TEMP/vcre...15.exe
windows10-2004-x64
7DISBELIEF.exe
windows10-2004-x64
6ExecuteShell.dll
windows10-2004-x64
3Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...al.ini
windows10-2004-x64
$PLUGINSDI...er.bmp
windows10-2004-x64
7$PLUGINSDI...rd.bmp
windows10-2004-x64
7data.win
windows10-2004-x64
3discord_ri...ce.dll
windows10-2004-x64
3license.txt
windows10-2004-x64
1options.ini
windows10-2004-x64
1Analysis
-
max time kernel
417s -
max time network
441s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 21:25
Static task
static1
Behavioral task
behavioral1
Sample
disbelief-installer.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$TEMP/vcredist_x86_2015.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
DISBELIEF.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ExecuteShell.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
Uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
data.win
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
discord_rich_presence.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
license.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
options.ini
Resource
win10v2004-20240802-en
General
-
Target
license.txt
-
Size
2KB
-
MD5
916c4589c406f7c0524e12ba8bb46373
-
SHA1
3dde8d42028ed22173d2801adc742e996c396504
-
SHA256
2c88d719c0e7ee8aafd407571ac6f1a374bd8c431ed22ea4520dd543cce29ea3
-
SHA512
6cb08f79586468c9181531071acf7cc1cf5d92d1bbe96b784e6641a28ca6301b420db3fb9172a256ef1610f04930ecd283a13e1dffa5907e8de4222c9c0156d8
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3680 NOTEPAD.EXE