Overview
overview
10Static
static
10250514-jzbn3sfj5s.zip
windows10-2004-x64
1241105-dtx...ed.zip
windows10-2004-x64
1d91912b4b9...37.rar
windows10-2004-x64
108751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
731.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
106306868794.bin.zip
windows10-2004-x64
169c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
3Archive.zi...3e.exe
windows10-2004-x64
8CVE-2018-1...oC.swf
windows10-2004-x64
3DiskIntern...en.exe
windows10-2004-x64
3E2-2020111...59.zip
windows10-2004-x64
1ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3Malware
windows10-2004-x64
1OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js.zip
windows10-2004-x64
1b2bd3de3e5...bb.zip
windows10-2004-x64
1Resubmissions
20/05/2025, 20:23
250520-y572ss1qv8 1020/05/2025, 20:10
250520-yx65jabr7v 1014/05/2025, 08:25
250514-kbrwtsfk31 10Analysis
-
max time kernel
97s -
max time network
212s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2025, 20:23
Static task
static1
Behavioral task
behavioral1
Sample
250514-jzbn3sfj5s.zip
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
241105-dtxrgatbpg_pw_infected.zip
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
d91912b4b945e88e881e54573390e6723cfc41916b6546453b59e60f9beee337.rar
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
6306868794.bin.zip
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
CVE-2018-15982_PoC.swf
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
E2-20201118_141759.zip
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Malware
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js.zip
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.zip
Resource
win10v2004-20250502-en
General
-
Target
OnlineInstaller.exe
-
Size
3.6MB
-
MD5
4b042bfd9c11ab6a3fb78fa5c34f55d0
-
SHA1
b0f506640c205d3fbcfe90bde81e49934b870eab
-
SHA256
59c662a5207c6806046205348b22ee45da3f685fe022556716dbbd6643e61834
-
SHA512
dae5957c8eee5ae7dd106346f7ea349771b693598f3d4d54abb39940c3d1a0b5731c8d4e07c29377838988a1e93dcd8c2946ce0515af87de61bca6de450409d3
-
SSDEEP
98304:ghXqJiXwwhwvxR7FI6wYroMUQrYeoFj6bjsKzZx7T7:ghXqsX3hs79bxiEbgKX7
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\iaStorE.sys OnlineInstaller.tmp -
Executes dropped EXE 1 IoCs
pid Process 1784 OnlineInstaller.tmp -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira OnlineInstaller.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\system32\KH.dat OnlineInstaller.tmp File created C:\Windows\system32\usp20.dll OnlineInstaller.tmp File created C:\Windows\system32\UP.dat OnlineInstaller.tmp File created C:\Windows\system32\spoolsr.exe OnlineInstaller.tmp File created C:\Windows\system32\MS.dat OnlineInstaller.tmp File created C:\Windows\system32\KeyHook64.dll OnlineInstaller.tmp -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OnlineInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OnlineInstaller.tmp -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5372 OnlineInstaller.exe Token: SeLoadDriverPrivilege 5372 OnlineInstaller.exe Token: SeDebugPrivilege 1784 OnlineInstaller.tmp Token: SeLoadDriverPrivilege 1784 OnlineInstaller.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5372 wrote to memory of 1784 5372 OnlineInstaller.exe 87 PID 5372 wrote to memory of 1784 5372 OnlineInstaller.exe 87 PID 5372 wrote to memory of 1784 5372 OnlineInstaller.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\OnlineInstaller.exe"C:\Users\Admin\AppData\Local\Temp\OnlineInstaller.exe"1⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\OnlineInstaller.tmpC:\Users\Admin\AppData\Local\Temp\OnlineInstaller.tmp -install2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD54b042bfd9c11ab6a3fb78fa5c34f55d0
SHA1b0f506640c205d3fbcfe90bde81e49934b870eab
SHA25659c662a5207c6806046205348b22ee45da3f685fe022556716dbbd6643e61834
SHA512dae5957c8eee5ae7dd106346f7ea349771b693598f3d4d54abb39940c3d1a0b5731c8d4e07c29377838988a1e93dcd8c2946ce0515af87de61bca6de450409d3