Analysis
-
max time kernel
251s -
max time network
207s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-10-2024 00:43
General
-
Target
setup_shenzhen_io_gog-3_(11.14.2020)_(43141).exe
-
Size
388.7MB
-
MD5
00e200c1e21bdad75fb6644606470080
-
SHA1
c55fabad647a720f1254d360c48252931fb88825
-
SHA256
e51c01de976c19d1f6b597546b6550e852eab6e02720c44778b214c9324af98c
-
SHA512
8b4c88bd9c0c714ed6a78188347bb7500d00772c5e605534c16b546b82b5fe636b41b5a7736e36e98e4cf661a8e8d2c32a9ea12b7d0385a53b0bcf43f244baa7
-
SSDEEP
12582912:orZro437kT1UaUUYsjHPLy+Z8peLdYnVXMRzPvlVj:oD3oTfUds3y+8IdMVXMRb3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 33 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_shenzhen_io_gog-3_(11.14.2020)_(43141).exe"C:\Users\Admin\AppData\Local\Temp\setup_shenzhen_io_gog-3_(11.14.2020)_(43141).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HDL2H.tmp\setup_shenzhen_io_gog-3_(11.14.2020)_(43141).tmp"C:\Users\Admin\AppData\Local\Temp\is-HDL2H.tmp\setup_shenzhen_io_gog-3_(11.14.2020)_(43141).tmp" /SL5="$B027C,406911138,192512,C:\Users\Admin\AppData\Local\Temp\setup_shenzhen_io_gog-3_(11.14.2020)_(43141).exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5affc3e585bb9494eafd700d82f4d80cc
SHA13fb1d1928325168036a0ed85d316073bced79ce7
SHA256236940d537f53efd0455838e48b13c4397d85c77717bdc15d64086466a237ed3
SHA5127ac1f3e6f27697612870c31b953d7e6cea2cf47c8e1da744130085b59600eb24c53089af5c046fb97a683fb631c839d29b99fbee210b19134093cee1972dc986
-
Filesize
226KB
MD5005a1b8990b0e03078e1e60a15dbd331
SHA1c117ab17455e76643545d5270e3d0c87910215db
SHA256d74ab7a29505700b0aaa8fb7539f7a8b42a9f820e7bb4d25e3bfd559e3e8f0ff
SHA512e35a8e361da8c3a2ff1a224de7aa2806db913ab80306e59dce4bf5d39e0407deb0ce4b7ed1d013f17011f700ad880de39ed33695e05be2726718e642b562c0eb
-
Filesize
172KB
MD5797c8d06f7d490211a81ec099ac8b912
SHA1272f946417ef1a2411a99a652c265306340fe9dc
SHA2567e1e03d940faaa9de85235dc431e8b8f1d90199847897d74bc046215ca34b801
SHA512cd860bb8e5177f014f884b1ea5c6d5106345d61a2495ecdb6229b17196b944f2bdba16208149311ff7b52d7f9832bfcc5089dfe1a682b3531c77fecd8688e7d4
-
Filesize
3KB
MD55b43a5d975a53f4fc1da67ce9f7784c1
SHA18543fa1e471030049942252b23cb22e0880c3af5
SHA25659d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a
SHA5125dd5c4e9859a555a4a32da76f5231b44f7556274c6501da530b2cdd570bcb4675f710bee708322a40ed3ef9280c0d652b4e7ef0e9eaf128c08534f59291917f5
-
Filesize
2KB
MD5461dfeb75927bdb39f9db5348612a611
SHA1b7893b1fff6801e37ee7337d876962a09184941e
SHA2560de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c
SHA51268528cf45c81c2c024a672f42c2cd6d4f72c015b443f103ca21deb8ee2bec4f4027490e7f33b5338a87537b5bf7f255f2828aed149f622155ec89cc81687651b
-
Filesize
1KB
MD5c596bc9111edc702bbbb29b70984254f
SHA1d4712c7b91ff4f8994e7907d31357c42eb47c738
SHA2566112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462
SHA512db50d0a39ec644873a03d64552fff1776cc94f016e8dfc8918e65aee94f7529a6de4637567b5e65c4ea988f3775785c4b52c2d96fe8dbc52b1e21ff59c737c2a
-
Filesize
333KB
MD522c84320736f7138d085518ba3a2bb7d
SHA19954a9220eb72efc7fe338189e2b3a7aa24fc4ea
SHA2569f3b77306ef90b15f34ca20c7cb56614333db6025aac47dac921688c3fd31ad2
SHA5124ba814aa4f438d4cc7603de151177a4498b8250bd3ae2958d581f391aee1a8725a583a2ecfdddd7c196f947634be159cd22a63f7b2939a6fc4867744dcecb426
-
Filesize
35KB
MD50177746573eed407f8dca8a9e441aa49
SHA16b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA256a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
SHA512d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a
-
Filesize
8KB
MD53befe9739354ee24a0b1ea8df05ce274
SHA1ab0bda986a8c46aa19f57b75a2b7b22445a3c625
SHA256b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47
SHA512ac016a59e0bfc9b22c376ae5d498c5660893a983d932b2bd502dabe032883c69e79ea8d93c2db49f95415c3cdb068e9f7d1d85527a4f9e68e065a989852d09dd
-
Filesize
69KB
MD51d51fac9e2384eeb674199cfd5281d7d
SHA1861dfdc121357d605d0cc3793266713788109eb2
SHA25623e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec
SHA512921b00adfe43b883200960e8d0958d4e6b97f6d5cfc096ee277766a3e44cc7805a20877a4edf8bd4d9102bb71a20ac218a9a512f4f76bd751d3ef14f4e0a6eda
-
Filesize
726B
MD5df10adc25b673e74e19971c17bee5a98
SHA1ee16fb1cf9491f5e611282f0574b27d76fede412
SHA256142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b
SHA512dc3de10e0321966cbbfb2e57b3b41da6f26dff0c7233a47469da58775b5c471e6b5181e4d4ffc81ef8b83dbcad74ccc1aad7678518f99c9185a441d2a23e010f
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
1KB
MD5103c1368e60806b1b7995a0894eacf87
SHA1971392527f6e4b655044773132505c901a6b5469
SHA2560d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e
SHA512652177e94438aff102f2ed873b26f0985ebed134763852b49b1ca2698463c1dbeb85152f19c8e18d397229ec5cb2cd1d17c61d454ab7c425a2cab540adc8228a
-
Filesize
302B
MD515fab287549b0ebe823a0e01c2d1680a
SHA126b469fe2c17f19c7e86c060816f89b1e4346054
SHA256176a9d45de5faf2dbe72144bc7e3e8b4b49f20ecab9201e5a2cdde1eb3b40899
SHA512ac00a290e55ca81f5df7b690859037d9f6c277b0309ead77d8f313fa4339b1c40bbae9111b1938e265c074dea240ae84200592e8d849eff03e279182ac20f5b8
-
Filesize
691KB
MD57db706c324cc9b6fda497d081eed6e26
SHA1ca97392e573af0cf61bfa3301801a85f2beea44c
SHA256cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0
SHA5128edf1494d57d5e708faaff4170f21f435658be897a6fe0acf243ced0701a7fd574b3c973c5bc5e8d92815e966c98977e69ac1e3083ab00c11b072115527ffa19
-
Filesize
50KB
MD5a22c200b257c6c2864f04a2b549c30a8
SHA1abf554f041b4d99ca49099da17a4910ca5bd6ae0
SHA2560281c173e3aa61e5d9d403966540ea07be32fcda6a26697a7dcfaaefef448211
SHA5125b3a3c2404634c450dca2ca2bf8cc14cd7954d8a7cd47afacdb132234afb5ef297807d34a4b8fb125128af7dbe0da031a992d7542365a3fcf290c70ab4a72e13
-
Filesize
1.3MB
-
Filesize
84KB
-
Filesize
732KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
84KB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
732KB
-
Filesize
84KB
-
Filesize
1.3MB
-
Filesize
84KB
-
Filesize
56KB
-
Filesize
1.3MB
-
Filesize
56KB
-
Filesize
1.3MB
-
Filesize
84KB
-
Filesize
1.3MB
-
Filesize
84KB
-
Filesize
1.3MB
-
Filesize
84KB
-
Filesize
1.3MB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
1.3MB
-
Filesize
84KB
-
Filesize
228KB
-
Filesize
68KB
-
Filesize
228KB
