Overview
overview
10Static
static
3Setup.exe
windows10-2004-x64
10msvcp100.dll
windows10-2004-x64
3msvcr100.dll
windows10-2004-x64
3x64/Templa...te.htm
windows10-2004-x64
3x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...re.dll
windows10-2004-x64
1x64/plugin...po.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...me.dll
windows10-2004-x64
1x64/plugin...io.dll
windows10-2004-x64
1x64/plugin...to.dll
windows10-2004-x64
1x64/plugin...me.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...al.dll
windows10-2004-x64
1x64/plugin...gn.dll
windows10-2004-x64
1x64/plugin...ht.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...rn.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...me.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...on.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows10-2004-x64
1Resubmissions
17-09-2024 11:12
240917-navg4szenq 317-09-2024 11:09
240917-m9bcvazclb 317-09-2024 11:07
240917-m79gvszbqc 10Analysis
-
max time kernel
91s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-09-2024 11:07
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
msvcp100.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
msvcr100.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
x64/Templates/TemplateCorreoCliente.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
x64/plugins/MahApps.Metro.IconPacks.BootstrapIcons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
x64/plugins/MahApps.Metro.IconPacks.BoxIcons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
x64/plugins/MahApps.Metro.IconPacks.Codicons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
x64/plugins/MahApps.Metro.IconPacks.Coolicons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
x64/plugins/MahApps.Metro.IconPacks.Core.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
x64/plugins/MahApps.Metro.IconPacks.Entypo.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
x64/plugins/MahApps.Metro.IconPacks.EvaIcons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
x64/plugins/MahApps.Metro.IconPacks.FeatherIcons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
x64/plugins/MahApps.Metro.IconPacks.FileIcons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
x64/plugins/MahApps.Metro.IconPacks.FontAwesome.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
x64/plugins/MahApps.Metro.IconPacks.Fontaudio.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
x64/plugins/MahApps.Metro.IconPacks.Fontisto.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
x64/plugins/MahApps.Metro.IconPacks.ForkAwesome.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
x64/plugins/MahApps.Metro.IconPacks.Ionicons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
x64/plugins/MahApps.Metro.IconPacks.JamIcons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral20
Sample
x64/plugins/MahApps.Metro.IconPacks.Material.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
x64/plugins/MahApps.Metro.IconPacks.MaterialDesign.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral22
Sample
x64/plugins/MahApps.Metro.IconPacks.MaterialLight.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
x64/plugins/MahApps.Metro.IconPacks.Microns.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral24
Sample
x64/plugins/MahApps.Metro.IconPacks.Modern.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
x64/plugins/MahApps.Metro.IconPacks.Octicons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral26
Sample
x64/plugins/MahApps.Metro.IconPacks.PicolIcons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
x64/plugins/MahApps.Metro.IconPacks.PixelartIcons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral28
Sample
x64/plugins/MahApps.Metro.IconPacks.RPGAwesome.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
x64/plugins/MahApps.Metro.IconPacks.RadixIcons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral30
Sample
x64/plugins/MahApps.Metro.IconPacks.RemixIcon.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
x64/plugins/MahApps.Metro.IconPacks.SimpleIcons.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral32
Sample
x64/plugins/MahApps.Metro.IconPacks.Typicons.dll
Resource
win10v2004-20240802-en
General
-
Target
Setup.exe
-
Size
80KB
-
MD5
2a8613b7d99903516b8fe02fd820bf52
-
SHA1
78a96addcb556ab1d490fac80f929305263d06b9
-
SHA256
f1d68c5e7c7660d4f2ce412c109b7fe3e088872fa0ebe61ca9ab9dd92a496407
-
SHA512
af0902aeb6169ea507b787da7b61c3533df4610c3f51c1d8f65dfc9008c8ce2580f2d86a49a4d0acc2c51c731f3e4c447d0d1d8e779dc1c75e43d30b79c46436
-
SSDEEP
1536:9A8oAY5SXfidLez+Q+EGfdUHLLXJ+CqoVpPBucQwk7qnKXKo5OMY8xk03ben8TK:M7Ohz+Q+EGlUHLLXJ+CqoTPBucQwktXS
Malware Config
Extracted
lumma
https://dumpliportiwo.shop/api
https://keennylrwmqlw.shop/api
https://licenseodqwmqn.shop/api
https://tendencctywop.shop/api
https://tesecuuweqo.shop/api
https://relaxatinownio.shop/api
https://reggwardssdqw.shop/api
https://eemmbryequo.shop/api
https://tryyudjasudqo.shop/api
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 552 StrCmp.exe -
Loads dropped DLL 1 IoCs
pid Process 2372 updater.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3048 set thread context of 4956 3048 Setup.exe 82 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\updater.exe more.com -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language more.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StrCmp.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\Version = "2.1" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F} StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\0 StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\TypeLib StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F} StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\VERSION StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\FLAGS\ = "0" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ = "cBluetoothDaemon" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32 StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D} StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid32 StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\Forward\ = "{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ = "cBluetoothDaemon" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid32 StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6} StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\HELPDIR StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32 StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon\Clsid StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\Implemented Categories StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1 StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\EDW\\ZRVVBPCDSWKMAHZOMK\\StrCmp.exe" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32 StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\Version = "2.1" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\ = "BtDaemon.cBluetoothDaemon" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791} StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\EDW\\ZRVVBPCDSWKMAHZOMK" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC} StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\Forward StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\0\win32 StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "_cBluetoothDaemon" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\LocalServer32 StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\VERSION\ = "2.1" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "cBluetoothDaemon" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\FLAGS StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\Version = "2.1" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32 StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\Forward StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\Forward\ = "{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}" StrCmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC} StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ = "__cBluetoothDaemon" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon\ = "BtDaemon.cBluetoothDaemon" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" StrCmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}" StrCmp.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3048 Setup.exe 3048 Setup.exe 4956 more.com 4956 more.com -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3048 Setup.exe 4956 more.com -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 552 StrCmp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3048 wrote to memory of 552 3048 Setup.exe 81 PID 3048 wrote to memory of 552 3048 Setup.exe 81 PID 3048 wrote to memory of 552 3048 Setup.exe 81 PID 3048 wrote to memory of 4956 3048 Setup.exe 82 PID 3048 wrote to memory of 4956 3048 Setup.exe 82 PID 3048 wrote to memory of 4956 3048 Setup.exe 82 PID 3048 wrote to memory of 4956 3048 Setup.exe 82 PID 4956 wrote to memory of 2372 4956 more.com 91 PID 4956 wrote to memory of 2372 4956 more.com 91 PID 4956 wrote to memory of 2372 4956 more.com 91 PID 4956 wrote to memory of 2372 4956 more.com 91 PID 4956 wrote to memory of 2372 4956 more.com 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Roaming\EDW\ZRVVBPCDSWKMAHZOMK\StrCmp.exeC:\Users\Admin\AppData\Roaming\EDW\ZRVVBPCDSWKMAHZOMK\StrCmp.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:552
-
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Program Files\Google\Chrome\Application\updater.exe"C:\Program Files\Google\Chrome\Application\updater.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2372
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
994KB
MD5de0ea31558536ca7e3164c3cd4578bf5
SHA15cc890c3ade653bb1ed1e53dabb0410602ee52df
SHA2566e599490e164505af796569dce30e18218b179b2b791fe69764892b3ed3e7478
SHA512c47299cd5f3b4961f423c2ca1fef5a33eb4b0f63dc232af70ef9da39f6f82270406061dd543461de7e47abd1244e26d6190de6035120211b27d4c23f97a25aba
-
Filesize
2.1MB
MD57514588e0a6b92d7e27d7ce757a49710
SHA128440dc824c40f85860b24c8352f3e39307d2bec
SHA256051e8be64329b6b8aa9cc0684b6f705a3f9d245b8d46786caf57ca393ec164c5
SHA51257a374b1c11f87c70ad700e0edb981b31239a46598d34315ae736cc663242b7c0d7f52144ed3e12813003697252d4bbd1ed4a29afe723ca3405e499e36a505dd
-
Filesize
47KB
MD5916d7425a559aaa77f640710a65f9182
SHA123d25052aef9ba71ddeef7cfa86ee43d5ba1ea13
SHA256118de01fb498e81eab4ade980a621af43b52265a9fcbae5dedc492cdf8889f35
SHA512d0c260a0347441b4e263da52feb43412df217c207eba594d59c10ee36e47e1a098b82ce633851c16096b22f4a4a6f8282bdd23d149e337439fe63a77ec7343bc