9c1c4b043577300a8ebd0b9840d887ac7e0dde4dcdb99e98ea19129e2646c501

General

Target
setupglx.exe
Size 2.7MB
Sample260710-gzedvsfx2v
SHA256 9c1c4b043577300a8ebd0b9840d887ac7e0dde4dcdb99e98ea19129e2646c501
MD5 c34c7d88242724f72a33c9bc7cc9a1d5
SHA1 d368d83cd1920023635f346725ab77304e28de33
SHA512 8984810b88d54c75bc2d6f9f9b2408c366188382e798ace21f02ee3a17110a68d46ab336c4a9d0cc4bbde1748afb8de4998f6b9313f041ad83f5afb62653bbba
SSDEEP 49152:PHbnTVI3cw8JMdRaUy+02/uJb+X74NLCIJGomemFaLESMBHCXwiI6iIG1K:DTfw2M7fy+0Vi74sIJGv9kAizFGg
TLSH
T12ED5338998E2E9F2DA0246F0C5C3B76B5227BC94E9109517FBF17DB3B8B35B1320A154
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
836	internalsetupglx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4332	836	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setupglx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internalsetupglx.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
836	internalsetupglx.exe
836	internalsetupglx.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 836	2172	setupglx.exe	85

C:\Users\Admin\AppData\Local\Temp\setupglx.exe
"C:\Users\Admin\AppData\Local\Temp\setupglx.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\nsc49C8.tmp\internalsetupglx.exe
  C:\Users\Admin\AppData\Local\Temp\nsc49C8.tmp\internalsetupglx.exe C:/Users/Admin/AppData/Local/Temp/nsc49C8.tmp /baseInstaller='C:/Users/Admin/AppData/Local/Temp/setupglx.exe' /fallbackfolder='C:/Users/Admin/AppData/Local/Temp/nsc49C8.tmp/fallbackfiles/'
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 2056
    3⤵
    - Program crash
    PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 836 -ip 836
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A70FB2EF91304AA8B34E01ED114875C9_LogFile.txt

Path C:\Users\Admin\AppData\Local\Temp\A70FB2EF91304AA8B34E01ED114875C9\A70FB2EF91304AA8B34E01ED114875C9_LogFile.txt
Size 10KB
SHA256 314170eae37fc5d8d80da0227e8c2aef095cd93055b8feeaca7058eda88b4e41
MD5 9d52d5778a5ce27ed714e771585c4a6e
SHA1 0d8a40643333a307e90ed883be9006b1b16b0008
SHA512 9ae9c9c34aa0ede1cd8c869b05d1e298d370839670afce4b4f534e46e592bb2d2e5c2684f536fd6098a81156d94575aedb9286aa0b2ed7085b1a467847dff822
SSDEEP 192:qH1LHnHfHnHYlH6HgoHRHoHs+2H4NHDTH/HwHcHnHLH9RQZ:qHNHnHfHnHcH6H1HRHoHs+2H4NH3H/HW
TLSH
T10E22627A0702D1E9418414FFE038CFC62364459FAE74AA68EF2B02C476EDB91DB6B5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\A70FB2EF91304AA8B34E01ED114875C9\index.html
Size 344KB
SHA256 520d6deec31868a90da51cda53ef1b458d9d44e6f603c4328ab21cacc72660ef
MD5 fac6cb50d02adcd70f0ae8d13297acdf
SHA1 263749993647650ced117c4542662244858ac50a
SHA512 cae6178fce0a265b6722c0f0512a899db7962d0c97614790a9dd66bf6ff9831885615f7447b39fa56a366449fc81c6920ee8a7c32d69b3d5919bd509a8d9aeda
SSDEEP 6144:A5TXHLcxbN0AgL6opP4N+vbosn5KhsSXUZrFI03biegnk4ea9VA5YF5gU55l8YF:A5TXHLcxbN0AgL6opP4MKhLaV4n
TLSH
T158746C8EB282B535BFE3231A009B25717137B8216509C4B0F6DADC9459FAF085277B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.7ze

Path C:\Users\Admin\AppData\Local\Temp\nsc49C8.tmp\fallbackfiles\index.7ze
Size 120KB
SHA256 a9a75a44568d2d19db87a22a4bf9c09f2db6e3fce0d5c8f72d8220aab085001c
MD5 9e072df77035435b6492e4595deef1c7
SHA1 0b86366bd31d59144d4cb12075a8f87b45cbb7a7
SHA512 3a9180a104f8164d48a2b319ecb1e44d2c5b01ee8b515c617f0ea0af419075974ef1cabd52c18cbadf20eb9abcdc708055f3ab1d7268f22a895b35764f748a58
SSDEEP 3072:y4Q3XXJlB9CkG/L0uXoHyXBJG5C0VgYayH7Q7aHd:RQ3HtjG/L0u5XyHgO7Qu9
TLSH
T12AC3130DB96F5E9D507310B771A7A2FAF1E6D06B3A61EF2DC0234069D248903C9E909F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

internalsetupglx.exe

Path C:\Users\Admin\AppData\Local\Temp\nsc49C8.tmp\internalsetupglx.exe
Size 1.8MB
SHA256 8b64258249dc34d1d7c68324735323190c949f3d9766122676bf7051afc3310d
MD5 27dbebefac44d6947bc6fcc5e7b662da
SHA1 872239b048d6b9f889e3f538b8c909c99f182790
SHA512 bde18aed3250028a6977e555cf094f26be3b31f2053a5e7ec0e2b576255418dcaa453a9e2e8a84c22461fd049128204a6696a1604200cce5674d4878698cb1e3
SSDEEP 49152:pnGcxOUi39yHebZTcNHTXpSliV2s1/ctYmwYDdd:pNYymZZP
TLSH
T193858C92F682C031D5A10572D078D6FE807A6F74E321A9E753DC3EA629319C1E939F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

internalsetupglx_icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nsc49C8.tmp\internalsetupglx_icon.ico
Size 33KB
SHA256 38cc854a6ab4f309fa959070512921b50264e47e91f6112a794e7a36eafb45c7
MD5 4ab0e50745d4f8a51308e5c9574f349b
SHA1 2204912cc038fc93c6e62852bb8ff8eeecbd5ad4
SHA512 fb19533696c1cdcabc2f661939619c0715e90222f5e300cf1c3b57cfc812f70f23c8c9a74ed4f768a08d2f1b0d96029a6791fc8d50b3495bf6aad1b391cdce0e
SSDEEP 768:s/DM/tnV3hD9PErpMg74xEqSnKe7aIPGzK:s/DMbhD2p74xEqSnK2aIPr
TLSH
T1CBF2F58332C1C752D05A7AB6C09348E64A2F2C0DDD60A457FAF93DB7B5BA275312913D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

internalsetupglx_splash.png

Path C:\Users\Admin\AppData\Local\Temp\nsc49C8.tmp\internalsetupglx_splash.png
Size 23KB
SHA256 d8380020d3e9c17be7d329b424f04ec03312749f06a4e89c99f5d965e3f82623
MD5 86ce7739a0de1b10d19a3836021ce375
SHA1 405f46139ef981e9216b5fa19ce5bd06a6dd1b5b
SHA512 9d96e44441aadb802149fa6eb7975939f6c7818e5f7328784a273976c53d50ed65d12445501c8b5b6eda639552be1d771793d8cbe8e31e95ab1164fc8a8e3cb1
SSDEEP 384:HXE05Tsw1jVgy/j0iTG7x1tSIGMx4TV55WG0rtdKJ4qy5iGTAj2MVZkRUg6me/Wr:335ThBdW7fIIGMxQ4G0rtW4q4iG42u8v
TLSH
T115B2D01F5854415AB79EB047CE5F1AAC0BA11D684DAC3F3CE78B9ECB442BF013A35126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/836-72-0x0000000003C60000-0x0000000003C61000-memory.dmp

Download

memory/2172-166-0x0000000000400000-0x0000000000443000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads