Overview
overview
10Static
static
3MetaLab.zip
windows7-x64
1MetaLab.zip
windows10-2004-x64
1MetaLab/Co...ig.dll
windows7-x64
3MetaLab/Co...ig.dll
windows10-2004-x64
3MetaLab/Co...ct.dll
windows7-x64
3MetaLab/Co...ct.dll
windows10-2004-x64
3MetaLab/Co...in.dll
windows7-x64
3MetaLab/Co...in.dll
windows10-2004-x64
3MetaLab/Co...nu.dll
windows7-x64
3MetaLab/Co...nu.dll
windows10-2004-x64
3MetaLab/Co...up.dll
windows7-x64
3MetaLab/Co...up.dll
windows10-2004-x64
3MetaLab/Co...wh.dll
windows7-x64
3MetaLab/Co...wh.dll
windows10-2004-x64
3MetaLab/Core.dll
windows7-x64
1MetaLab/Core.dll
windows10-2004-x64
1MetaLab/Data.dll
windows7-x64
1MetaLab/Data.dll
windows10-2004-x64
1MetaLab/Drawing.dll
windows7-x64
1MetaLab/Drawing.dll
windows10-2004-x64
1MetaLab/Fo...AR.ttf
windows7-x64
3MetaLab/Fo...AR.ttf
windows10-2004-x64
7MetaLab/Fo...um.ttf
windows7-x64
3MetaLab/Fo...um.ttf
windows10-2004-x64
7MetaLab/HowToUse.txt
windows7-x64
1MetaLab/HowToUse.txt
windows10-2004-x64
1MetaLab/MetaLab.exe
windows7-x64
10MetaLab/MetaLab.exe
windows10-2004-x64
10MetaLab/Th...a.json
windows7-x64
3MetaLab/Th...a.json
windows10-2004-x64
3MetaLab/msvcp140.dll
windows7-x64
1MetaLab/msvcp140.dll
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 01:15
Static task
static1
Behavioral task
behavioral1
Sample
MetaLab.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
MetaLab.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
MetaLab/Configs/config.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
MetaLab/Configs/config.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
MetaLab/Configs/inject.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
MetaLab/Configs/inject.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
MetaLab/Configs/main.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
MetaLab/Configs/main.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
MetaLab/Configs/menu.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
MetaLab/Configs/menu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
MetaLab/Configs/up.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
MetaLab/Configs/up.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
MetaLab/Configs/wh.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
MetaLab/Configs/wh.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
MetaLab/Core.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
MetaLab/Core.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
MetaLab/Data.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
MetaLab/Data.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
MetaLab/Drawing.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
MetaLab/Drawing.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
MetaLab/Fonts/PTSANS-REGULAR.ttf
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
MetaLab/Fonts/PTSANS-REGULAR.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
MetaLab/Fonts/SFProDisplay-Medium.ttf
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
MetaLab/Fonts/SFProDisplay-Medium.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
MetaLab/HowToUse.txt
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
MetaLab/HowToUse.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
MetaLab/MetaLab.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
MetaLab/MetaLab.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
MetaLab/Themes/Insomnia.json
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
MetaLab/Themes/Insomnia.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
MetaLab/msvcp140.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
MetaLab/msvcp140.dll
Resource
win10v2004-20240802-en
General
-
Target
MetaLab/Themes/Insomnia.json
-
Size
5KB
-
MD5
13ca13758fab652f89ed4867520d88c8
-
SHA1
3d5263a7a4ee40a6d581de0d73b81ff9dc35bf9e
-
SHA256
4196e53858d0a10ec9cf9adbc8ffaf8be4690c02c1a3d0b228c3732e803410ec
-
SHA512
d0268b59d8abe9ad21aee73b3cdc8dbe0690041669297a23b60c88d4c7b1782a189c80f490b2c297c54394e635a28800a75f654aeb2c42db3aa4ce139ba0d1a1
-
SSDEEP
48:HNIwsW9kwny3UT5f533WRw7iB7AmYBWwd2WnWtf5Wj3WCWlWwWGRPfWqWNWKge3e:n0C00p2WThzhoWhoBhehjhEhNhMhBhW
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\json_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\json_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.json rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2748 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2748 AcroRd32.exe 2748 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2784 2612 cmd.exe 31 PID 2612 wrote to memory of 2784 2612 cmd.exe 31 PID 2612 wrote to memory of 2784 2612 cmd.exe 31 PID 2784 wrote to memory of 2748 2784 rundll32.exe 32 PID 2784 wrote to memory of 2748 2784 rundll32.exe 32 PID 2784 wrote to memory of 2748 2784 rundll32.exe 32 PID 2784 wrote to memory of 2748 2784 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\MetaLab\Themes\Insomnia.json1⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MetaLab\Themes\Insomnia.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MetaLab\Themes\Insomnia.json"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58b4051327a7428110353bc2d12fb1c53
SHA168fb4e31058bb64db7394d9f675b6589a6ec6f56
SHA256998d06e91c05a82265e7f454f1ba605487be0af1da74ff335ab921329e219d62
SHA512b5c5fa7d010c1878c8bbaf1f8eb9be9bb6f8c78e1191b7316b6ced7705512901aedbd912f85140446a44a379903ab100bcf503ecb765fac9fffe850c59a2a74f