Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26-12-2020 20:20

General

  • Target

    64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe

  • Size

    115KB

  • MD5

    448838b2a60484ee78c2198f2c0c9c85

  • SHA1

    f2c43a01cabaa694228f5354ea8c6bcf3b7a49b3

  • SHA256

    64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273

  • SHA512

    9e532af06e5f4764529211e8c5c749baa7b01c72f11b603218c3c08d70cf1e732f8d9d81ec257ca247aaa96d1502150a2f402b1b3914780b6344222b007dd53f

Score
10/10

Malware Config

Signatures

  • SlothfulMedia

    SlothfulMedia is a malware used by sophisticated threat actors that drops a remote access tool.

  • SlothfulMedia Main Payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe
    "C:\Users\Admin\AppData\Local\Temp\64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:492
    • C:\Users\Admin\AppData\Roaming\Media\mediaplayer.exe
      "C:\Users\Admin\AppData\Roaming\Media\mediaplayer.exe"
      2⤵
      • Executes dropped EXE
      PID:2512
    • C:\Users\Admin\AppData\Local\Temp\p_DMO.exe
      "C:\Users\Admin\AppData\Local\Temp\p_DMO.exe"
      2⤵
      • Executes dropped EXE
      • Deletes itself
      PID:2168

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads