cb2757792673b5b344336c6be45e855b1674826c435d1257434d3df434a0627b

Resubmissions

14/09/2024, 02:42

240914-c7fvfasglp 8

14/09/2024, 02:37

240914-c4gmkaseqn 7

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Installer.exe
Size

120.4MB
MD5

36d0b5b1ed9a76523d7279752d995b9a
SHA1

a555ca2f60a5c80b145c5405002fa3e1b29268a8
SHA256

fc3146019e85fad7a1d2e2049fc7c45105d3cd337d2531967829103d87fe6bb3
SHA512

bd1312889a51dbf716001084a972bdbfbb0c44260adcb54c593bef078a394bc494dbc34a8a87a6d908674745c85d27fd9fe1c44f56636f8e60190ddf88bae3c9
SSDEEP

1572864:a1f0+Sva7Hdp1Nhn+aCdrvdYrZ/7/lbg8udR8SnuSE49z:3asulbg8yTnbEOz

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2648	Installer.exe
1728	Installer.exe
1728	Installer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2812	1728	Installer.exe	30
PID 1728 wrote to memory of 2648	1728	Installer.exe	31
PID 1728 wrote to memory of 2648	1728	Installer.exe	31
PID 1728 wrote to memory of 2648	1728	Installer.exe	31
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32
PID 1728 wrote to memory of 532	1728	Installer.exe	32

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --field-trial-handle=1124,8842169610905053782,10245063904046746060,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1120 /prefetch:2
  2⤵
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1124,8842169610905053782,10245063904046746060,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --field-trial-handle=1124,8842169610905053782,10245063904046746060,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1184 /prefetch:2
  2⤵
  PID:532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2812-1-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2812-33-0x0000000077500000-0x0000000077501000-memory.dmp

Filesize
4KB

Download