64aa8d782c42ce119a9ec22a91ef5a7a5ebeff81b0c461b8b8edffe4a715103d

Analysis

max time kernel
146s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
03-07-2024 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

!ŞetUp_26874--#PaSꞨKḙy#$$/Setup.exe
Size

1.1MB
MD5

f975a2d83d63a473fa2fc5206b66bb79
SHA1

e49d21f112ab27ae0953aff30ae122440cf164b9
SHA256

6a2d3876003f6c68f824df4f0033564d8c230716908ba2e6c06ea1dd6d5f98e8
SHA512

4af4ce56bf131432d488ed112f8858c1e1392d013c6ac0603f2fd70ed513091e35854c0f678efeab7fa9a551517c6b9698f40a92729112de4b852fa3c0c69d64
SSDEEP

12288:IbCylcTVPbi7vT1K7n6HpVkg8KHIo5u0K1VmMxEnbuvuY2jTU+LHMA+nk2oG1ts:4lcTVPbikTMkg8KH/mmMxnvfphx8

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 1992 set thread context of 220 1992 Setup.exe more.com
Loads dropped DLL 1 IoCs

Processes:

Beep.au3

pid process

2252 Beep.au3
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Setup.exemore.com

pid process

1992 Setup.exe
1992 Setup.exe
220 more.com
220 more.com
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Setup.exemore.com

pid process

1992 Setup.exe
220 more.com

description	pid	process	target process
PID 1992 set thread context of 220	1992	Setup.exe	more.com

pid	process
2252	Beep.au3

pid	process
1992	Setup.exe
1992	Setup.exe
220	more.com
220	more.com

pid	process
1992	Setup.exe
220	more.com

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Setup.exemore.com

description	pid	process	target process
PID 1992 wrote to memory of 220	1992	Setup.exe	more.com
PID 1992 wrote to memory of 220	1992	Setup.exe	more.com
PID 1992 wrote to memory of 220	1992	Setup.exe	more.com
PID 1992 wrote to memory of 220	1992	Setup.exe	more.com
PID 220 wrote to memory of 2252	220	more.com	Beep.au3
PID 220 wrote to memory of 2252	220	more.com	Beep.au3
PID 220 wrote to memory of 2252	220	more.com	Beep.au3
PID 220 wrote to memory of 2252	220	more.com	Beep.au3

C:\Users\Admin\AppData\Local\Temp\!ŞetUp_26874--#PaSꞨKḙy#$$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\!ŞetUp_26874--#PaSꞨKḙy#$$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:220

C:\Users\Admin\AppData\Local\Temp\Beep.au3
C:\Users\Admin\AppData\Local\Temp\Beep.au3
3⤵
- Loads dropped DLL
PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Beep.au3
Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\a8b75081
Filesize
1.9MB

MD5
f860ccfa5670a961042fe7b2e338e1d2

SHA1
207c3af394d58d75f2c5294691ede7af8cf8f1b0

SHA256
3453db0136f54db5588eb29a60fa0c638529cbec530b13e1da30fd1576817af6

SHA512
e9af1843e351878193a8fc92e703a2b5a94dc94043147ee499a18f034df82e007ed53950993cdcd525fcb17866efcd99d5f53d7e35a1f4a49be2157b3f92456a

Download Submit
memory/220-13-0x00000000758F0000-0x0000000075A6D000-memory.dmp

Filesize
1.5MB

Download
memory/220-16-0x00000000758F0000-0x0000000075A6D000-memory.dmp

Filesize
1.5MB

Download
memory/220-22-0x00000000758FE000-0x0000000075900000-memory.dmp

Filesize
8KB

Download
memory/220-9-0x00007FF8D1FE0000-0x00007FF8D21E9000-memory.dmp

Filesize
2.0MB

Download
memory/220-12-0x00000000758FE000-0x0000000075900000-memory.dmp

Filesize
8KB

Download
memory/220-11-0x00000000758F0000-0x0000000075A6D000-memory.dmp

Filesize
1.5MB

Download
memory/1992-0-0x00007FF8C3190000-0x00007FF8C330A000-memory.dmp

Filesize
1.5MB

Download
memory/1992-6-0x00007FF8C3190000-0x00007FF8C330A000-memory.dmp

Filesize
1.5MB

Download
memory/1992-4-0x00007FF8C31A8000-0x00007FF8C31A9000-memory.dmp

Filesize
4KB

Download
memory/1992-5-0x00007FF8C3190000-0x00007FF8C330A000-memory.dmp

Filesize
1.5MB

Download
memory/2252-18-0x00007FF8D1FE0000-0x00007FF8D21E9000-memory.dmp

Filesize
2.0MB

Download
memory/2252-19-0x00000000001D0000-0x000000000022C000-memory.dmp

Filesize
368KB

Download
memory/2252-21-0x0000000000087000-0x000000000008F000-memory.dmp

Filesize
32KB

Download
memory/2252-23-0x00000000001D0000-0x000000000022C000-memory.dmp

Filesize
368KB

Download