cb2757792673b5b344336c6be45e855b1674826c435d1257434d3df434a0627b

Resubmissions

14/09/2024, 02:42

240914-c7fvfasglp 8

14/09/2024, 02:37

240914-c4gmkaseqn 7

Analysis

max time kernel
439s
max time network
1163s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
14/09/2024, 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Installer.exe
Size

120.4MB
MD5

36d0b5b1ed9a76523d7279752d995b9a
SHA1

a555ca2f60a5c80b145c5405002fa3e1b29268a8
SHA256

fc3146019e85fad7a1d2e2049fc7c45105d3cd337d2531967829103d87fe6bb3
SHA512

bd1312889a51dbf716001084a972bdbfbb0c44260adcb54c593bef078a394bc494dbc34a8a87a6d908674745c85d27fd9fe1c44f56636f8e60190ddf88bae3c9
SSDEEP

1572864:a1f0+Sva7Hdp1Nhn+aCdrvdYrZ/7/lbg8udR8SnuSE49z:3asulbg8yTnbEOz

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4052	Installer.exe
4052	Installer.exe
2780	Installer.exe
2780	Installer.exe
2780	Installer.exe
2780	Installer.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 564	3332	Installer.exe	78
PID 3332 wrote to memory of 4052	3332	Installer.exe	79
PID 3332 wrote to memory of 4052	3332	Installer.exe	79
PID 3332 wrote to memory of 2780	3332	Installer.exe	81
PID 3332 wrote to memory of 2780	3332	Installer.exe	81

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --field-trial-handle=1604,14917001817448343847,13398579759565474578,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1592 /prefetch:2
  2⤵
  PID:564
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,14917001817448343847,13398579759565474578,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --field-trial-handle=1604,14917001817448343847,13398579759565474578,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1540 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-2-0x00007FFD10F80000-0x00007FFD10F81000-memory.dmp

Filesize
4KB

Download