Analysis
- max time kernel
145s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/12/2024, 03:35
General
- Target 1028/VisualStudioSetup.exe
- Size 4.2MB
- Sample241220-d5ttysyjes
- SHA256 d448c1792d67d14755dcfab8922e6f5a4d1caf4ff9b66545e85181c03b8d1f39
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 21 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1028\VisualStudioSetup.exe"C:\Users\Admin\AppData\Local\Temp\1028\VisualStudioSetup.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1cbb3323f2e63d3d546ffdc776\vs_bootstrapper_d15\vs_setup_bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\1cbb3323f2e63d3d546ffdc776\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\AppData\Local\Temp\1028\VisualStudioSetup.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\AppData\Local\Temp\1028"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\getmac.exe"getmac"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
20241220033745_04deeff3e9f64a3c93fbfb0dcde774aa.trn
Microsoft.C2RSignatureReader.Interop.dll
Microsoft.C2RSignatureReader.Native.dll
Microsoft.VisualStudio.RemoteControl.dll
Microsoft.VisualStudio.Setup.Common.dll
Microsoft.VisualStudio.Setup.Download.dll
Microsoft.VisualStudio.Setup.dll
Microsoft.VisualStudio.Telemetry.dll
Microsoft.VisualStudio.Utilities.Internal.dll
Newtonsoft.Json.dll
System.Memory.dll
System.Runtime.CompilerServices.Unsafe.dll
detection.json
vs_setup_bootstrapper.config
vs_setup_bootstrapper.exe
vs_setup_bootstrapper.exe.config
vs_setup_bootstrapper.json
memory/972-124-0x0000000005E90000-0x0000000005F24000-memory.dmp
memory/972-116-0x0000000000E90000-0x0000000000EF8000-memory.dmp
memory/972-141-0x0000000006410000-0x00000000064C2000-memory.dmp
memory/972-149-0x0000000006380000-0x00000000063A6000-memory.dmp
memory/972-137-0x0000000072900000-0x00000000730B0000-memory.dmp
memory/972-153-0x0000000006350000-0x0000000006358000-memory.dmp
memory/972-157-0x0000000006820000-0x0000000006830000-memory.dmp
memory/972-132-0x00000000058C0000-0x00000000058C8000-memory.dmp
memory/972-136-0x0000000005DF0000-0x0000000005E40000-memory.dmp
memory/972-128-0x0000000006030000-0x000000000612C000-memory.dmp
memory/972-120-0x0000000005A80000-0x0000000005BEA000-memory.dmp
memory/972-165-0x0000000006B50000-0x0000000006B72000-memory.dmp
memory/972-166-0x0000000006B80000-0x0000000006ED4000-memory.dmp
memory/972-168-0x0000000007670000-0x00000000076D6000-memory.dmp
memory/972-169-0x0000000007A10000-0x0000000007AA2000-memory.dmp
memory/972-170-0x0000000008260000-0x0000000008804000-memory.dmp
memory/972-173-0x0000000008810000-0x00000000088CA000-memory.dmp
memory/972-145-0x0000000006210000-0x0000000006224000-memory.dmp
memory/972-175-0x0000000072900000-0x00000000730B0000-memory.dmp
memory/972-176-0x000000000A9C0000-0x000000000A9C8000-memory.dmp
memory/972-177-0x000000000A9F0000-0x000000000A9F8000-memory.dmp
memory/972-178-0x0000000072900000-0x00000000730B0000-memory.dmp
memory/972-181-0x0000000072900000-0x00000000730B0000-memory.dmp
memory/972-180-0x000000000AA50000-0x000000000AA5E000-memory.dmp
memory/972-179-0x000000000B310000-0x000000000B348000-memory.dmp
memory/972-182-0x0000000072900000-0x00000000730B0000-memory.dmp
memory/972-183-0x0000000072900000-0x00000000730B0000-memory.dmp
memory/972-184-0x0000000072900000-0x00000000730B0000-memory.dmp
memory/972-185-0x0000000072900000-0x00000000730B0000-memory.dmp
memory/972-190-0x000000007290E000-0x000000007290F000-memory.dmp
memory/972-191-0x0000000072900000-0x00000000730B0000-memory.dmp
memory/972-192-0x0000000072900000-0x00000000730B0000-memory.dmp
memory/972-193-0x0000000072900000-0x00000000730B0000-memory.dmp
memory/972-194-0x0000000072900000-0x00000000730B0000-memory.dmp
memory/972-114-0x000000007290E000-0x000000007290F000-memory.dmp