Analysis
- max time kernel
1790s - max time network
1157s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
21/09/2024, 17:08
General
- Target Sausage Fattener/setup.exe
- Size 3.9MB
- Sample240921-vnmsratcld
- SHA256 81e45c1e6d6a718624159e116e6daa8c1547f39bef7f56163303e7eca8abfae1
Malware Config
Signatures
- Detects Strela Stealer payload 2 IoCs
- Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
- Loads dropped DLL 13 IoCs
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sausage Fattener\setup.exe"C:\Users\Admin\AppData\Local\Temp\Sausage Fattener\setup.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
AdvSplash.dll
Bass.dll
InstallOptions.dll
NSIS_SkinCrafter_Plugin.dll
SkinCrafter.dll
System.dll
ioSpecial.ini
mfc71.dll
msvcr71.dll
memory/5204-154-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-160-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-44-0x0000000003F20000-0x0000000003FEC000-memory.dmp
memory/5204-34-0x00000000047F0000-0x0000000004DBD000-memory.dmp
memory/5204-26-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-15-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-133-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-134-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-135-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-136-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-137-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-138-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-139-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-140-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-141-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-142-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-143-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-144-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-145-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-146-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-147-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-148-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-149-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-150-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-151-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-152-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-153-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-16-0x000000000314C000-0x000000000314D000-memory.dmp
memory/5204-155-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-156-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-157-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-158-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-159-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-27-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-161-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-162-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-163-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-164-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-165-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-166-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-167-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-168-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-169-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-170-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-171-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-172-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-173-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-174-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-175-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-176-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-177-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-178-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-179-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-180-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-181-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-182-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-183-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-184-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-185-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-186-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-187-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-188-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-189-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-190-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-191-0x0000000003100000-0x000000000314D000-memory.dmp
memory/5204-192-0x0000000003100000-0x000000000314D000-memory.dmp