Analysis

  • max time kernel
    7s
  • max time network
    0s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    14-10-2024 18:30

General

  • Target

    Setup.exe

  • Size

    7.8MB

  • MD5

    df1d332701dba8a7312877093b0786c1

  • SHA1

    f6461519a41c70f8f7a93f1b42e5c3aa72ab6e32

  • SHA256

    0af3c3c3ddc5761a8a02a38b827eedcb6669096da5222e4c93e39ea79b1df392

  • SHA512

    140832ec54b8c240b92a1d004530b46e48312d4a38311dc90ed504b96942c1708e660a69e665b8917fb5a2c2d73072e2b1329bd5bcb507bc4f88a7830fc0ec4b

  • SSDEEP

    196608:ijV2D6FSA1HeT39Iig5Tet4Q4GEX/O2XNsIJMsbnMYI93:WV2Dq1+TtIiOS2NXNsIasbncx

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Users\Admin\AppData\Local\Temp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
      2⤵
      • Loads dropped DLL
      PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-file-l2-1-0.dll

    Filesize

    22KB

    MD5

    cdfc83e189bda0ac9eab447671754e87

    SHA1

    cf597ee626366738d0ea1a1d8be245f26abbea72

    SHA256

    f4811f251c49c9ae75f9fe25890bacede852e4f1bfdc6685f49096253a43f007

    SHA512

    659ee46e210fcad6c778988a164ce3f69a137d05fb2699ff662540cbb281b38719017f1049d5189fafdae06c07a48d3d29dd98e11c1cae5d47768c243af37fe9

  • C:\Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    22KB

    MD5

    f1d0595773886d101e684e772118d1ef

    SHA1

    290276053a75cbeb794441965284b18311ab355d

    SHA256

    040e1572da9a980392184b1315f27ebcdaf07a0d94ddf49cbd0d499f7cdb099a

    SHA512

    db57f4ae78f7062cfe392d6829c5975be91d0062ff06725c45c06a74e04ade8bcaf709cfebeba8146fb4396206141aa49572968ea240aa1cba909e43985dc3ee

  • C:\Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    22KB

    MD5

    e26a5e364a76bf00feaab920c535adbb

    SHA1

    411eaf1ca1d8f1aebcd816d93933561c927f2754

    SHA256

    b3c0356f64e583c8aca3b1284c6133540a8a12f94b74568fb78ddc36eac6ab15

    SHA512

    333e42eeea07a46db46f222e27429facaaf2ce8a433f0c39f5d5c72e67d894c813d3cf77880434f6373e0d8fffa3ef96d5f37e38dd4775491f3da2b569e9df59

  • C:\Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    22KB

    MD5

    566232dabd645dcd37961d7ec8fde687

    SHA1

    88a7a8c777709ae4b6d47bed6678d0192eb3bc3f

    SHA256

    1290d332718c47961052ebc97a3a71db2c746a55c035a32b72e5ff00eb422f96

    SHA512

    e5d549c461859445006a4083763ce855adbb72cf9a0bcb8958daa99e20b1ca8a82dec12e1062787e2ae8aee94224b0c92171a4d99ed348b94eab921ede205220

  • C:\Users\Admin\AppData\Local\Temp\_MEI25362\python312.dll

    Filesize

    6.6MB

    MD5

    cae8fa4e7cb32da83acf655c2c39d9e1

    SHA1

    7a0055588a2d232be8c56791642cb0f5abbc71f8

    SHA256

    8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

    SHA512

    db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

  • C:\Users\Admin\AppData\Local\Temp\_MEI25362\ucrtbase.dll

    Filesize

    1.1MB

    MD5

    a9f5b06fae677c9eb5be8b37d5fb1cb9

    SHA1

    5c37b880a1479445dd583f85c58a8790584f595d

    SHA256

    4e9e93fd6486571e1b5dce381fa536fb6c5593584d3330368ccd47ee6107bf52

    SHA512

    5d7664716fa52f407d56771862262317ac7f4a03f31f209333c3eea7f1c8cf3d5dbafc1942122948d19208d023df220407014f47e57694e70480a878822b779a

  • \Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-file-l1-2-0.dll

    Filesize

    22KB

    MD5

    852904535068e569e2b157f3bca0c08f

    SHA1

    c79b4d109178f4ab8c19ab549286eee4edf6eddb

    SHA256

    202b77cd363fce7c09d9a59b5779f701767c8734cc17bbe8b9ece5a0619f2225

    SHA512

    3e814678c7aa0d3d3a637ce3048e3b472dbb01b2e2a5932e5b257aa76bf8de8117a38e2a352daff66939a73c1b971b302f5635ea1d826b8a3afa49f9b543a541

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.