Analysis
-
max time kernel
29s -
max time network
6s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-10-2024 17:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win11-20241007-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
plugins/NetworkTools.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
plugins/NetworkTools.dll
Resource
win11-20240802-en
windows11-21h2-x64
5 signatures
150 seconds
General
-
Target
Setup.exe
-
Size
1.4MB
-
MD5
68f9b52895f4d34e74112f3129b3b00d
-
SHA1
c5e2018bf7c0f314fed4fd7fe7e69fa2e648359e
-
SHA256
d4a0fe56316a2c45b9ba9ac1005363309a3edc7acf9e4df64d326a0ff273e80f
-
SHA512
1cd875f9d0301b14645ea608fe61560a229ee395fa061f32675c3d84e41916998f887278d8497a5e875be22ba8fcbcfcbd878a5e2ed1746dc75430b7aed5fede
-
SSDEEP
24576:fsmjNvgp+pxECAucO9iWFT0z7rLuUhFP3MGX:PFgpAiIiWdzUz35X
Score
10/10
Malware Config
Extracted
Family
legion
C2
dns-beast.com
Attributes
-
url_paths
hittest.php
-
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Signatures
-
Legion, RobotDropper, Satacom
Legion aka 'RobotDropper' or 'Satacom' is a malware downloader written in C++ and Legion stealer is written C#.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4016 set thread context of 2304 4016 Setup.exe 77 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 Setup.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4016 Setup.exe Token: SeIncBasePriorityPrivilege 4016 Setup.exe Token: 33 4016 Setup.exe Token: SeLoadDriverPrivilege 4016 Setup.exe Token: SeProfSingleProcessPrivilege 4016 Setup.exe Token: SeRestorePrivilege 4016 Setup.exe Token: SeShutdownPrivilege 4016 Setup.exe Token: SeTakeOwnershipPrivilege 4016 Setup.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe -
Suspicious use of SendNotifyMessage 27 IoCs
pid Process 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe 4016 Setup.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4016 wrote to memory of 2304 4016 Setup.exe 77 PID 4016 wrote to memory of 2304 4016 Setup.exe 77 PID 4016 wrote to memory of 2304 4016 Setup.exe 77 PID 4016 wrote to memory of 2304 4016 Setup.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:2304
-