Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system - submitted
30/12/2025, 15:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
baeda28958587a925f15c460df45b3838af3805ca25c18651b318aa377d3ef36.msi
Resource
win10v2004-20251231-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
baeda28958587a925f15c460df45b3838af3805ca25c18651b318aa377d3ef36.msi
Resource
win11-20251231-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target baeda28958587a925f15c460df45b3838af3805ca25c18651b318aa377d3ef36.msi
- Size 24.1MB
- Sample251230-stbxbsav6e
- SHA256 baeda28958587a925f15c460df45b3838af3805ca25c18651b318aa377d3ef36
- MD5 ce9184f0a004b44ea67b76dda6a39f38
- SHA1 dd2e1e2cc610549233f91ec348cd1e214393e773
- SHA512 c2e6228a30590ca6aeaa409e9283e2f2f9df0d9662ab07313ac3d6131be8efe7f05a3f727fffa617d9c0d7fa6cb16352343e1388df0ef0bc691dde54174352c1
- SSDEEP 393216:xgeYaxy2zuYLOy4ORNcN3Lkk2dhSm0pcktXS7f2EBLqayZF3A90NbpO7EVIddzME:xlNyIKORg3LFud0ppof2dRpOEJN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Legion family
- Legion, RobotDropper, Satacom
Legion aka 'RobotDropper' or 'Satacom' is a malware downloader written in C++ and Legion stealer is written C#.
- Loads dropped DLL 6 IoCs
pid Process 5932 MsiExec.exe 5932 MsiExec.exe 5932 MsiExec.exe 5932 MsiExec.exe 5932 MsiExec.exe 5932 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSICD17.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICC88.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF6CB194EFC300E4F2.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF4D8989791F436382.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF4F8A84CD421441E8.TMP msiexec.exe File opened for modification C:\Windows\Installer\e57c97a.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF92A73F2AF40BC680.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{309A21C9-D884-4627-B425-D57BAD8858B1} msiexec.exe File created C:\Windows\Installer\e57c97e.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSICA26.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICD56.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICD77.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDDF2.tmp msiexec.exe File created C:\Windows\Installer\e57c97a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSICD06.tmp msiexec.exe -
pid Process 3060 powershell.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5444 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3060 powershell.exe 3060 powershell.exe 3176 msiexec.exe 3176 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5444 msiexec.exe Token: SeIncreaseQuotaPrivilege 5444 msiexec.exe Token: SeSecurityPrivilege 3176 msiexec.exe Token: SeCreateTokenPrivilege 5444 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5444 msiexec.exe Token: SeLockMemoryPrivilege 5444 msiexec.exe Token: SeIncreaseQuotaPrivilege 5444 msiexec.exe Token: SeMachineAccountPrivilege 5444 msiexec.exe Token: SeTcbPrivilege 5444 msiexec.exe Token: SeSecurityPrivilege 5444 msiexec.exe Token: SeTakeOwnershipPrivilege 5444 msiexec.exe Token: SeLoadDriverPrivilege 5444 msiexec.exe Token: SeSystemProfilePrivilege 5444 msiexec.exe Token: SeSystemtimePrivilege 5444 msiexec.exe Token: SeProfSingleProcessPrivilege 5444 msiexec.exe Token: SeIncBasePriorityPrivilege 5444 msiexec.exe Token: SeCreatePagefilePrivilege 5444 msiexec.exe Token: SeCreatePermanentPrivilege 5444 msiexec.exe Token: SeBackupPrivilege 5444 msiexec.exe Token: SeRestorePrivilege 5444 msiexec.exe Token: SeShutdownPrivilege 5444 msiexec.exe Token: SeDebugPrivilege 5444 msiexec.exe Token: SeAuditPrivilege 5444 msiexec.exe Token: SeSystemEnvironmentPrivilege 5444 msiexec.exe Token: SeChangeNotifyPrivilege 5444 msiexec.exe Token: SeRemoteShutdownPrivilege 5444 msiexec.exe Token: SeUndockPrivilege 5444 msiexec.exe Token: SeSyncAgentPrivilege 5444 msiexec.exe Token: SeEnableDelegationPrivilege 5444 msiexec.exe Token: SeManageVolumePrivilege 5444 msiexec.exe Token: SeImpersonatePrivilege 5444 msiexec.exe Token: SeCreateGlobalPrivilege 5444 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeDebugPrivilege 3060 powershell.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe Token: SeTakeOwnershipPrivilege 3176 msiexec.exe Token: SeRestorePrivilege 3176 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5444 msiexec.exe 5444 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3176 wrote to memory of 5932 3176 msiexec.exe 78 PID 5932 wrote to memory of 3060 5932 MsiExec.exe 79
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\baeda28958587a925f15c460df45b3838af3805ca25c18651b318aa377d3ef36.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5444
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B08DAC6D4D6391C4B0D27E196E5B90712⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssCE20.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiCE1D.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrCE1E.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrCE1F.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57c97d.rbs
- Size 22KB
- SHA256 07bdf8576850ac6faaaea20116fb4091a80fde91fbfe9caa7c6a8f9a222d709e
- MD5 9bbdc36ff84a71f850a626b27ed6c6bd
- SHA1 1d0a7cb09110f3f4588cd7d10e58292261da5369
- SHA512 7faecef8f1ea738a09e547eca93ce278bee549d07c4dd2bc92957068f315b6593082ef0552dda66891b2fa712a8c283b9a3b6fba9651ddd94e2ecb3440dcd7cf
- SSDEEP 384:PdxdagXq3eq65k9mzVhpvNai+BxwulziYWWuSBVAoGbynRUIFf5MSgsAFaGD0eji:PdxdagXq3eq65k9KVhpvNai+Bxwul2Yn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cuzhowol.gnp.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\msiCE1D.txt
- Size 54B
- SHA256 4ca8664da66ad8c90ce03725f92bf7571cf86a290a9ec4a073dad293a60836ef
- MD5 9f5bffbb1f8f8340bf45e22a09517ee1
- SHA1 a5566c63b3681cd56e3b76ed528449ca33a36cc6
- SHA512 8b1b1d13de5aee1748428ffe1ee6131a63e819df8dd42088b7d581ff957adb30e12ba3637e00fac7d7b5aa71a5e35ce09f52772d38f1c441adb19e5e2cd05423
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\pssCE20.ps1
- Size 6KB
- SHA256 53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
- MD5 30c30ef2cb47e35101d13402b5661179
- SHA1 25696b2aab86a9233f19017539e2dd83b2f75d4e
- SHA512 882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
- SSDEEP 96:5Wb5VNkKmeHn/V2BVrIovmgNlGjxcj6BngOcvjb:5WbyZ/gVyvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\scrCE1E.ps1
- Size 590B
- SHA256 a355f4f5ef030fabb0a314a7a3631af2374e1c93d1dc80569a2503dd2fdd8f7d
- MD5 3646d1fd6085c78c33f5561ac21287b8
- SHA1 9c1644660d949e9492ce440d5d93642d2d6e5eda
- SHA512 019dea6c3bd9e480350dca5ce399ae403e40800c2c1533a1ebfd5d74d8e31852c0f1d76f51e542121f0cb0bb34cdf4f838405c91bbf0c4ac008f429441c06ebe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Tdgus Avodw Public\TjboApp\vstdlib_s.dll
- Size 1.2MB
- SHA256 2095b813d33151ac10013f384952b59b0430681e585891e3a93c2ea2ec094736
- MD5 cc8e3164a20c09956b80911b50cbf831
- SHA1 19363b341fd10c1685c2bee4806d4a2e698139b5
- SHA512 0bb02276d9e58a70d34b406f0035730d5bf1fef0ae0476954ebe3f650136e25754f4f3d802ef6f98d8bdac4f784cd7e71f31a5e1e1b9dc71c4ac1c22b124337f
- SSDEEP 24576:BXF6qIW4Okm9/0ti1ZISqJ5DfcGt8Fv/:BXF6qIW4OL/o0ISgUGiFv/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSICA26.tmp
- Size 738KB
- SHA256 ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504
- MD5 b158d8d605571ea47a238df5ab43dfaa
- SHA1 bb91ae1f2f7142b9099e3cc285f4f5b84de568e4
- SHA512 56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591
- SSDEEP 12288:+0WEHqIw3Gy6hFWBZGNTph0lhSMXle1Gf5PsTcuvX:+xDf3z6hFWHah0lhSMXlKW547vX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSICD77.tmp
- Size 758KB
- SHA256 9fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59
- MD5 fb4665320c9da54598321c59cc5ed623
- SHA1 89e87b3cc569edd26b5805244cfacb2f9c892bc7
- SHA512 b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf
- SSDEEP 12288:fiAYtRrp74AePn9x6yi29JBillKtlMF938ZIQ2KruEwRph0lhSMXleYfhsL65FmS:q7tkAeP9hib4lw938ZH2WITh0lhSMXlT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\e57c97a.msi
- Size 24.1MB
- SHA256 baeda28958587a925f15c460df45b3838af3805ca25c18651b318aa377d3ef36
- MD5 ce9184f0a004b44ea67b76dda6a39f38
- SHA1 dd2e1e2cc610549233f91ec348cd1e214393e773
- SHA512 c2e6228a30590ca6aeaa409e9283e2f2f9df0d9662ab07313ac3d6131be8efe7f05a3f727fffa617d9c0d7fa6cb16352343e1388df0ef0bc691dde54174352c1
- SSDEEP 393216:xgeYaxy2zuYLOy4ORNcN3Lkk2dhSm0pcktXS7f2EBLqayZF3A90NbpO7EVIddzME:xlNyIKORg3LFud0ppof2dRpOEJN
- MD5 SHA1 SHA512 SSDEEP