Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system - submitted
30/12/2025, 15:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
baeda28958587a925f15c460df45b3838af3805ca25c18651b318aa377d3ef36.msi
Resource
win10v2004-20251231-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
baeda28958587a925f15c460df45b3838af3805ca25c18651b318aa377d3ef36.msi
Resource
win11-20251231-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target baeda28958587a925f15c460df45b3838af3805ca25c18651b318aa377d3ef36.msi
- Size 24.1MB
- Sample251230-s1rlcsaw4a
- SHA256 baeda28958587a925f15c460df45b3838af3805ca25c18651b318aa377d3ef36
- MD5 ce9184f0a004b44ea67b76dda6a39f38
- SHA1 dd2e1e2cc610549233f91ec348cd1e214393e773
- SHA512 c2e6228a30590ca6aeaa409e9283e2f2f9df0d9662ab07313ac3d6131be8efe7f05a3f727fffa617d9c0d7fa6cb16352343e1388df0ef0bc691dde54174352c1
- SSDEEP 393216:xgeYaxy2zuYLOy4ORNcN3Lkk2dhSm0pcktXS7f2EBLqayZF3A90NbpO7EVIddzME:xlNyIKORg3LFud0ppof2dRpOEJN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Legion family
- Legion, RobotDropper, Satacom
Legion aka 'RobotDropper' or 'Satacom' is a malware downloader written in C++ and Legion stealer is written C#.
- Loads dropped DLL 6 IoCs
pid Process 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIB862.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIABBA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD15.tmp msiexec.exe File created C:\Windows\Installer\e5fab22.msi msiexec.exe File created C:\Windows\SystemTemp\~DF23069A93C79BE75A.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFD53F98CDFF7840DA.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5fab1e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIAD44.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD55.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF3472217CED282F04.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFC892C212AE6610B0.TMP msiexec.exe File created C:\Windows\Installer\e5fab1e.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIACD4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD14.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{309A21C9-D884-4627-B425-D57BAD8858B1} msiexec.exe -
pid Process 1164 powershell.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4812 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1164 powershell.exe 1164 powershell.exe 4888 msiexec.exe 4888 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4812 msiexec.exe Token: SeIncreaseQuotaPrivilege 4812 msiexec.exe Token: SeSecurityPrivilege 4888 msiexec.exe Token: SeCreateTokenPrivilege 4812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4812 msiexec.exe Token: SeLockMemoryPrivilege 4812 msiexec.exe Token: SeIncreaseQuotaPrivilege 4812 msiexec.exe Token: SeMachineAccountPrivilege 4812 msiexec.exe Token: SeTcbPrivilege 4812 msiexec.exe Token: SeSecurityPrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeLoadDriverPrivilege 4812 msiexec.exe Token: SeSystemProfilePrivilege 4812 msiexec.exe Token: SeSystemtimePrivilege 4812 msiexec.exe Token: SeProfSingleProcessPrivilege 4812 msiexec.exe Token: SeIncBasePriorityPrivilege 4812 msiexec.exe Token: SeCreatePagefilePrivilege 4812 msiexec.exe Token: SeCreatePermanentPrivilege 4812 msiexec.exe Token: SeBackupPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeShutdownPrivilege 4812 msiexec.exe Token: SeDebugPrivilege 4812 msiexec.exe Token: SeAuditPrivilege 4812 msiexec.exe Token: SeSystemEnvironmentPrivilege 4812 msiexec.exe Token: SeChangeNotifyPrivilege 4812 msiexec.exe Token: SeRemoteShutdownPrivilege 4812 msiexec.exe Token: SeUndockPrivilege 4812 msiexec.exe Token: SeSyncAgentPrivilege 4812 msiexec.exe Token: SeEnableDelegationPrivilege 4812 msiexec.exe Token: SeManageVolumePrivilege 4812 msiexec.exe Token: SeImpersonatePrivilege 4812 msiexec.exe Token: SeCreateGlobalPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeDebugPrivilege 1164 powershell.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4812 msiexec.exe 4812 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4888 wrote to memory of 5080 4888 msiexec.exe 78 PID 5080 wrote to memory of 1164 5080 MsiExec.exe 79
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\baeda28958587a925f15c460df45b3838af3805ca25c18651b318aa377d3ef36.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4812
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B03C79DA87229A0F7258BE262202B6182⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssAD82.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiAD7F.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrAD80.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrAD81.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5fab21.rbs
- Size 22KB
- SHA256 7626db1cb050168aa8709844783b62a0076df970d70f327976f7506bc732ef73
- MD5 dd818ab3765ddb7bb421ccc82fc834eb
- SHA1 84af49dc5211aab1d7e5bd17467c593501126783
- SHA512 0e024488c48d51712b7aa005fc54cae8df4c385bc24c01a336a0314e8e01d248745d7946d11306f792dfaa7458f7e80f8c76ef52222c546195d5453e26ac7417
- SSDEEP 384:4dxdagXq3eq65k9mzVhpvNai+BxwulziYWWuSBVAoGbynRUIFf5MSgsAFaGD0ejM:4dxdagXq3eq65k9KVhpvNai+Bxwul2YR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ec2djcyk.zhd.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\msiAD7F.txt
- Size 54B
- SHA256 4ca8664da66ad8c90ce03725f92bf7571cf86a290a9ec4a073dad293a60836ef
- MD5 9f5bffbb1f8f8340bf45e22a09517ee1
- SHA1 a5566c63b3681cd56e3b76ed528449ca33a36cc6
- SHA512 8b1b1d13de5aee1748428ffe1ee6131a63e819df8dd42088b7d581ff957adb30e12ba3637e00fac7d7b5aa71a5e35ce09f52772d38f1c441adb19e5e2cd05423
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\pssAD82.ps1
- Size 6KB
- SHA256 53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
- MD5 30c30ef2cb47e35101d13402b5661179
- SHA1 25696b2aab86a9233f19017539e2dd83b2f75d4e
- SHA512 882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
- SSDEEP 96:5Wb5VNkKmeHn/V2BVrIovmgNlGjxcj6BngOcvjb:5WbyZ/gVyvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\scrAD80.ps1
- Size 590B
- SHA256 a355f4f5ef030fabb0a314a7a3631af2374e1c93d1dc80569a2503dd2fdd8f7d
- MD5 3646d1fd6085c78c33f5561ac21287b8
- SHA1 9c1644660d949e9492ce440d5d93642d2d6e5eda
- SHA512 019dea6c3bd9e480350dca5ce399ae403e40800c2c1533a1ebfd5d74d8e31852c0f1d76f51e542121f0cb0bb34cdf4f838405c91bbf0c4ac008f429441c06ebe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Tdgus Avodw Public\TjboApp\vstdlib_s.dll
- Size 1.2MB
- SHA256 2095b813d33151ac10013f384952b59b0430681e585891e3a93c2ea2ec094736
- MD5 cc8e3164a20c09956b80911b50cbf831
- SHA1 19363b341fd10c1685c2bee4806d4a2e698139b5
- SHA512 0bb02276d9e58a70d34b406f0035730d5bf1fef0ae0476954ebe3f650136e25754f4f3d802ef6f98d8bdac4f784cd7e71f31a5e1e1b9dc71c4ac1c22b124337f
- SSDEEP 24576:BXF6qIW4Okm9/0ti1ZISqJ5DfcGt8Fv/:BXF6qIW4OL/o0ISgUGiFv/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIABBA.tmp
- Size 738KB
- SHA256 ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504
- MD5 b158d8d605571ea47a238df5ab43dfaa
- SHA1 bb91ae1f2f7142b9099e3cc285f4f5b84de568e4
- SHA512 56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591
- SSDEEP 12288:+0WEHqIw3Gy6hFWBZGNTph0lhSMXle1Gf5PsTcuvX:+xDf3z6hFWHah0lhSMXlKW547vX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIAD55.tmp
- Size 758KB
- SHA256 9fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59
- MD5 fb4665320c9da54598321c59cc5ed623
- SHA1 89e87b3cc569edd26b5805244cfacb2f9c892bc7
- SHA512 b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf
- SSDEEP 12288:fiAYtRrp74AePn9x6yi29JBillKtlMF938ZIQ2KruEwRph0lhSMXleYfhsL65FmS:q7tkAeP9hib4lw938ZH2WITh0lhSMXlT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\e5fab1e.msi
- Size 24.1MB
- SHA256 baeda28958587a925f15c460df45b3838af3805ca25c18651b318aa377d3ef36
- MD5 ce9184f0a004b44ea67b76dda6a39f38
- SHA1 dd2e1e2cc610549233f91ec348cd1e214393e773
- SHA512 c2e6228a30590ca6aeaa409e9283e2f2f9df0d9662ab07313ac3d6131be8efe7f05a3f727fffa617d9c0d7fa6cb16352343e1388df0ef0bc691dde54174352c1
- SSDEEP 393216:xgeYaxy2zuYLOy4ORNcN3Lkk2dhSm0pcktXS7f2EBLqayZF3A90NbpO7EVIddzME:xlNyIKORg3LFud0ppof2dRpOEJN
- MD5 SHA1 SHA512 SSDEEP