Overview
overview
7Static
static
3disbelief-...er.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...al.ini
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows10-2004-x64
7$PLUGINSDI...rd.bmp
windows10-2004-x64
7$TEMP/vcre...15.exe
windows10-2004-x64
7DISBELIEF.exe
windows10-2004-x64
6ExecuteShell.dll
windows10-2004-x64
3Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...al.ini
windows10-2004-x64
$PLUGINSDI...er.bmp
windows10-2004-x64
7$PLUGINSDI...rd.bmp
windows10-2004-x64
7data.win
windows10-2004-x64
3discord_ri...ce.dll
windows10-2004-x64
3license.txt
windows10-2004-x64
1options.ini
windows10-2004-x64
1Analysis
-
max time kernel
409s -
max time network
418s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2024 21:25
Static task
static1
Behavioral task
behavioral1
Sample
disbelief-installer.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$TEMP/vcredist_x86_2015.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
DISBELIEF.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ExecuteShell.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
Uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
data.win
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
discord_rich_presence.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
license.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
options.ini
Resource
win10v2004-20240802-en
General
-
Target
options.ini
-
Size
107B
-
MD5
a0b3f226abbb05d7d79d1e5934385174
-
SHA1
747ac8dada155f3b15580e3ce7d09fbbea78fdef
-
SHA256
b85dc03e952f9a4ab4f2cf8321767749122d6658f07e097e509535924ffab937
-
SHA512
f93d96933674a00dd4776013a82a955139819580dc2f25649b94376cbf182e25d624dfe2750d4d7661827163dbabd8154d5927904d5fd5c81149d9e2569aa449
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 924 NOTEPAD.EXE