𝐒𝐄𝐓𝐔𝐏[.]exe

resource
𝐒𝐄𝐓𝐔𝐏.exe
unpack001/$PLUGINSDIR/nsExec.dll

𝐒𝐄𝐓𝐔𝐏.exe

IMPHASH b729b61eb1515fcf7b3e511e4e66258b
SHA256 6aaa12302d88ebf9486d546f7c8c5ea0930ae6e5db2b70cbe0552dc3f57ee2e2
MD5 baf9949e853bc2a3479b10e6335e1bd2
SHA1 33bc48636e242db9bf5efbaebb53ef64b5f10276
SHA512 a5d705376cbec52d8d4ccce40803376870002d721bde052a1b917f0fa7b77a5a47bc7f0a09a9be31625bad52d7875e4d2471d3553cdde292b277b72e09fcc55b
SSDEEP 24576:IVD15G5gV/Sk60C2Vf6ugOFhmWGCPguQh7Xz8AFYklnresL7c/YyU:IRG6V/SkI2l6ieCIRn8AFYiCsc1U
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Bedroom.vstx

SHA256 83feb10bfceef64bd9410b15e84759571a1f1d426719d239e540a9611a38ee21
MD5 f7e7e908abcc768d9bbaccca49bf1b48
SHA1 b8beb9e42a255b0df2916f6ab7148ee6ce341f77
SHA512 5876e353d50c27a8ba18d31743f8ed658bf40abd95a832864cd0fdcc78332abbacb956b5329726926388a2fb7e75bfa20b7ea99e11d70d28bfbcdac208e0b9af
SSDEEP 3072:/Qjh2vo4UCjhmSMHaYmsIPBESNWimbevvIcMhC:/Q2vZ9lwDmXBESNWGvIDhC
MD5 SHA1 SHA512 SSDEEP

$TEMP/Brothers.vstx

SHA256 343e72146f70ba1fdaa429ab7ea176e778379672c69b5b850f1e29dfbc026fc6
MD5 9ce01f8bd4d26bf010c2ce5a3c24a486
SHA1 6cbea4633c7e55631ee48b8aa83241730cc865a9
SHA512 39aa8db497ff2e739ff9d96405e8e9ff42d3641fa35a4e6ae7e0135adc96e2249569a24e905ec4bff11227efa583d739adc1fcbda64090f5c0b6f7de1c26828b
SSDEEP 3072:OlHGmXQ/+0e+o3DFXGJcNjXYb8SvrXNCehbVUW3GorJ+yPIxt:mGB/+0no3DMJaTLSvBBV2orJ+N3
MD5 SHA1 SHA512 SSDEEP

$TEMP/Decision.vstx

SHA256 bd702742c189c30e23db3a3d98ee7be9a5b9a1df93661db2bfc95301ddedcbe9
MD5 e40e106e0755a24a72e235667318565c
SHA1 b8408124d32379eeecd6c6069279a1603a4381ea
SHA512 ecd91a9341ed83ee550ab59289ec41ab499e12015372eb6148dced159b29587ed2a7a65dafe309724f3e20167a298f258a4b901f34f9f9a14c80057ff57ee83b
SSDEEP 6144:G5VyEb1jRDTrXh+viF8AvXMPywqzp/lLI4h8:G5V3hFDTrXh58AEPPip/lLIE8
MD5 SHA1 SHA512 SSDEEP

$TEMP/Emotions.vstx

SHA256 7414c06085ea06415ddd48105489ab67a856fabad16a94086006659db2db1ccd
MD5 e7de3136ca05ec5a757d3e25412a2077
SHA1 dbd82a279d02cdd52e7f3b5ee9290c5e9e8acf4e
SHA512 a3473072ab325b1f1a80cfb6b14e5ddb9d977f28a3ebf265716ae207d911962466d83abb3e144939b61158df31c3d18234280a33d60541682b782e1a67e8977e
SSDEEP 384:zJP0yl/inMi+B85hb3qmlgs+DEbzZe4T7cuP/dVVOiMuCnbC9Zu:50yl/8Mv85hbVlh0EHs4ncuP/dVVDMjj
MD5 SHA1 SHA512 SSDEEP

$TEMP/Exceed.vstx

SHA256 9ff8f172856168899d49f8689aaba5da4ff4c65480e4ba09021f6ae1b45669b5
MD5 328e2c597e0a7a3296419f34601e3274
SHA1 76fe0964a5c78c09f429e4707de8de15fa626d47
SHA512 19e365af8ce42a39caf9ac38c9039830bc30bae1717b51012b0d9efbfd6a98afd71c83f58a0c3d5f86d3f2caa8fa2a99deec44645da638295d6502db2b257bc7
SSDEEP 12288:egvs+uSKu+o8xeVFhmKWGCD/3fg1193Oh:eIs+fKu8KFhmZGCTgTlm
MD5 SHA1 SHA512 SSDEEP

Ashley

SHA256 be5e3479895d45ef5f33e490360001524b19fd75238eae1d7f9a79598a877a5b
MD5 e8708ea9819bd319f8db16b472902727
SHA1 7fb8e2f0a8849c692166d2b7e330990864d96a81
SHA512 c42d87555447f6d4d147791686e338e7e6f1983e44bb219227c635e70acb4c59566a6c21a363a4a39bbc1fbb354da5db8a6d6c1b24a0859bc68769f8e3496821
SSDEEP 1536:kT2ubSWJKWNJELHW/EJlrZlYR+68cNk3smxUsb1yAwsc8MxqVbD61HOyU/CX2Cde:A2ubSW4wC2mYR+HUDXOXT/CfXib9
MD5 SHA1 SHA512 SSDEEP

Basic

SHA256 11bface4f9935633192a2955f1938efe29a8f6a30100191452de48ded4fba926
MD5 b797506e43539f88d2d0f44532bfd3e5
SHA1 03822181ed157498f64b1fe0fa743dd331591287
SHA512 d503048cd3d1b72e5de6315183ce98a7360b0dd5915e6a734fbeed685da484f72fd8ef15bbbb62fbc462a033782a7eb435471697d56e04297d9012e99c774bac
SSDEEP 3072:meVzOqD1IGuTpMgKYbwR5Exe2/RTX/4gxRuNkdKF9:mMdmVTfwc7/RTggXuN2KF9
MD5 SHA1 SHA512 SSDEEP

Bukkake

SHA256 0e3b17d50f0a8190a0858f4e66fe59a642f955265965b031d50e1644e2d8cabf
MD5 5ccb58e20379952e5ac7be3dce99d9e7
SHA1 69af1b5daf23777ab90ac3b64179797d8d0f0e35
SHA512 c643407d21bab9970ccbf5317ee42fea7df7334035a8a0d19801df0c4c4e36ccc0b55a4aca377427948885cefb0954e38d5cfed295be8bb95503205b956337f3
SSDEEP 768:Ih63EYr8qcDP8WBosd0bHazf0Tye4Ur2+9BrKHg:Ih63EYrDWyu0uZo2+9Br+g
MD5 SHA1 SHA512 SSDEEP

Investigations

SHA256 5cf94acfc3e8ef32d509b98d124968d47acc001e495529c22b9e6de5af49688b
MD5 3894771668f470e933b561b2c9f40719
SHA1 d4d1f05f6dbbc5d2f082a77bdf6d9892719586ea
SHA512 6a115e25adea6d1804023e652c7407d6fe0c3b2d9e666bdbfd4fc9015dcd1693c56b41111bd9a1daafa11926af29fa031ad843c8689cc9d2a0b1d1137e166f5f
SSDEEP 1536:M0EdQGQ9EtSijtNOKc+48918JsdVCsESNvmtpAi6JvAeInT3VCLIsL6:8tSijpcVMFXD5ypAXoegz86
MD5 SHA1 SHA512 SSDEEP

Polo

SHA256 35057fbe0773aa87befc4b8b53452e3519dd63801a73d07a75c82799db6a7df7
MD5 64e748233c517827f11deaa7ddf04601
SHA1 a540cbfed02389c55ba107bf3362535f4f84d556
SHA512 75cf41dc8c6313db37d5904d6db76647308ab695a215051b26a007aef1ae36220d5fbc3e365b09f4d95905219ccc608661c33ff650c82a646c30d5b077180878
MD5 SHA1 SHA512

Preservation

SHA256 b0a9ee4511cc724b541dc6a369a55d023338ed193c37aee764b9f457d6a7a409
MD5 1727d3dec2c4271805ddc98709a5ef2e
SHA1 46578d5c7ee66ee424db16e76834f387f4816a72
SHA512 e233072f913e986931a63ba99498cf4f52375d88cb1b0725538169959e0483690b1038989bed1a9cb575d75ba95a40ad5455977fa9f72341f97b35a034201d6f
SSDEEP 1536:UPuwaAwu+1PdJaGloaj6bs8jcd/TcI3s+uXkrfhrRj3:UvaAt+1Pfam6OzmkrJrRj
MD5 SHA1 SHA512 SSDEEP

Referred

SHA256 d99b0e2397fcdf101715049fe3eca67857cdb65b68c62f4f0d4ea45a2fa4ba61
MD5 5ae677747fddc360b91c49e2137cdd36
SHA1 31f50efc55ed2eef3637da631dcba34063a3fd37
SHA512 8192705a4246a9a213b251a1feed9634e6475590ebc20c125baaceae092b35f7376c3433f3908a412d430d60cef6408f06fb29cd3baffe87774009784549cc26
SSDEEP 1536:RWKbAAnPC2U1Ld/f/Yyiy2ozCt+JQ+Hcnka+EY8xCCfVYvLu4:2vYNyet+JQ+HcnkL8xCSVYvv
MD5 SHA1 SHA512 SSDEEP

Revenues

SHA256 b5faad41d8e86e500aab217cae48a8f0bdddca52d48ad9c017fd5881062e1bfa
MD5 84538fcbb89e9e1c9c557de5af1dbe06
SHA1 9904932dba90d05c4b35a9d535cc22af65c4ed78
SHA512 99ab144fc93b69aa34cbe5824d56aab64c87ec1a770e136218a4588c4449e1ce391db8783e6e9a7f9e1e9c6afedcb235d0d60b489c3d4bb9d6bd7c0227aa0fb0
SSDEEP 768:O9OTGQfoz66t4dP+8pN5XvrsY916ojfvSb2Tal0xiVWV9+k:OATG62rt4dP+iX7DjfvSSuyxiQ
MD5 SHA1 SHA512 SSDEEP

Subsequent

SHA256 a7bf46eb0e4ba41069bfa19ce6a1e11684a50c3c5c149c15c5c35c814b6a60e8
MD5 725fe72148383426658816d7da0b988a
SHA1 61ee44057350985b8a3f14dbbe372eeef132b1aa
SHA512 9c5e15c7ea6def3b5b9f13e834d53d6fff6660fb78309fb896af59b0d2f713a78d84f93f76d5b26ef8f8db1607d9233225f73d14032f5272709c44aeff094606
SSDEEP 3072:djC0O2iSW4QlXUxPrCtTRVB4Y3I09JwCIj4BPb1XuE/gc0Ag0Fuz08XvBNE:R1WUyB4Y3IW5Iuh0AOz04pS
MD5 SHA1 SHA512 SSDEEP

Talks

SHA256 8f9b2ed177e32005e41a6b9b0ad42c422ae14d6fdf06bd4858a35081e66ce46a
MD5 1730abddf14ecdbafd2d42a4054ea15e
SHA1 d097cc0d015f3559b92117caa0f43c5a8b9ab6ff
SHA512 bac4fd2323ccb84c4dfc3760937612fe97ece833b05ceb2acae18759b5b00f73f4ac7f60d03930f9278693db15cd0661f3ba8cc1a118e0b0df0343aed321c14b
SSDEEP 1536:Gohx6a+A3MDS661CZxbxY/jJHcUoNghHeqSkVj:9hx6vA3MD8jjJ8lghHzJd
MD5 SHA1 SHA512 SSDEEP

Unnecessary

SHA256 28262e8465aefacb52a7230b0db6218deb054eba8afbb8cbe6143befbfda1a63
MD5 407f8df7572a9878e6ca8a5132c5d10a
SHA1 343fba348730147b75e72b37b569d66a6baf2485
SHA512 f17944afbc424c865cf6ffd52b6a00191fab3060caffa563849275e83cd5c98bdb6ec6aea85f8668029548c0da6c3053c9ccd25c25723eb997b5b34bd8dfd5e9
SSDEEP 1536:P8ZIjOrOJ0ou3GerIUhj18Ehs5VqX25G5ClCQEiV2XaRodwTVCJ9XonOM4O7tiCH:PtjOrOJGGMBwvqXQGYlawwBonasLH
MD5 SHA1 SHA512 SSDEEP

𝐒𝐄𝐓𝐔𝐏.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Bedroom.vstx

$TEMP/Brothers.vstx

$TEMP/Decision.vstx

$TEMP/Emotions.vstx

$TEMP/Exceed.vstx

Ashley

Basic

Bukkake

Investigations

Polo

Preservation

Referred

Revenues

Subsequent

Talks

Unnecessary

Sharing

General

Malware Config

Signatures

File Explorer

𝐒𝐄𝐓𝐔𝐏.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Bedroom.vstx

$TEMP/Brothers.vstx

$TEMP/Decision.vstx

$TEMP/Emotions.vstx

$TEMP/Exceed.vstx

Ashley

Basic

Bukkake

Investigations

Polo

Preservation

Referred

Revenues

Subsequent

Talks

Unnecessary