Analysis
-
max time kernel
36s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 07:17
Static task
static1
Behavioral task
behavioral1
Sample
de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exe
Resource
win10v2004-20221111-en
General
-
Target
de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exe
-
Size
315KB
-
MD5
29496055e9ca6dc50650ebc2ed4d1f9e
-
SHA1
6dfb4f5a49392eaa8cc5632c7458fbed6ddd197d
-
SHA256
de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f
-
SHA512
3ab4331e978e3e2580facd785f8204f4666c8257bb386c3e35e7519d51a91edecaed07c36a1989454c422f5e02ad8d036a11bbacf1e889a254d9d0c55117ab94
-
SSDEEP
6144:hrpbUzkuvcBYC47l2xyfalkLUsx4Y0k8ojcX/pJ2enmrIJzO1LBut0njxxuQ9Ub:hrakuveY3hfaaLUsx4JkxjYJ2emrCz2c
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exepid process 1348 de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exe 1348 de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exe 1348 de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exepid process 1348 de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exe"C:\Users\Admin\AppData\Local\Temp\de3c99924b80b7fec0207190eb4cf30e76c9787f0c7a4268b5ce4035bb38719f.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\TsuE6C524B2.dllFilesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
\Users\Admin\AppData\Local\Temp\{7E5DE878-AAF6-422F-A0C4-E2D4A5BECA8E}\Custom.dllFilesize
91KB
MD5a6312af27b3d15b556341f63bce617ed
SHA127d5724ba3c3d14065184558a434a0e78e742edb
SHA256432adc14aeb197e7bc24a77d29a18e82b7c02047efb3a354e0c2ce95719a8cae
SHA512c08ec354dcd7e3455ad419d13d4cd3e748f8579b089baa9e0c0347ccd58bc80333d066fe291e5a120b58fe3603a8a084771f6d80c73c433c9b0f00931e4f3f8a
-
\Users\Admin\AppData\Local\Temp\{7E5DE878-AAF6-422F-A0C4-E2D4A5BECA8E}\_Setup.dllFilesize
173KB
MD5081c1ac0aaaaec8b4eb06c541a40592e
SHA1bedb928c8c3a44942405de146c7b6bd63a438c65
SHA2567db7c245ad224e7018f5478b3f7c4695144fe65319973c8c536840bba53e9ab8
SHA512df96ea85e670ef0c58108d92683115480ef57174e341672edc26d111738560bbe17781a26fe62da2d9091fdfc6e1a70f1822b09f22be7893ebecd7d08dcc57b2
-
memory/1348-55-0x0000000074F41000-0x0000000074F43000-memory.dmpFilesize
8KB