Overview

overview

7

Static

static

3

indent- 40120517.exe

windows7-x64

7

indent- 40120517.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2023 07:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    indent- 40120517.exe

  • Size

    302KB

  • MD5

    313524e6258ef1bdb3a175c90a0b2455

  • SHA1

    cea80ba15c62c703665c556316cbbc2a0a9a8bf9

  • SHA256

    57b9e598a2344a9f11ea57e9def885d0548034bbfd7020c697770bc68d12660d

  • SHA512

    05256d66284ff44e34127ef521309160c7e9c7f09cf77cf1038da858733d6c2e0ebf1fdfdab2dfa30501976d819c20b915157f48a9d12b77866d4f25c0f966ff

  • SSDEEP

    6144:AYa6F09XGjbm9UAuN3p+SBSV8T/kFQW81/OMdb27wAn7xRo7G5l:AYn09b9UAuN3ESBOEaY1GME8An7PkG5l

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\indent- 40120517.exe
    "C:\Users\Admin\AppData\Local\Temp\indent- 40120517.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Users\Admin\AppData\Local\Temp\indent- 40120517.exe
      "C:\Users\Admin\AppData\Local\Temp\indent- 40120517.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2216

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsu869C.tmp\tbwghfoiiu.dll
    Filesize

    86KB

    MD5

    42033ab4bbaa96e3454ee64250bd7caf

    SHA1

    0a65e0194af1d8e445361092f18929e2810c7a79

    SHA256

    86782fad55ddd9a12122810d4776f9105e5dae0d94b3bc1cc56f9d75eb4a9b2d

    SHA512

    3fcfdf6a858900224f3e6a96294da49b4fa472f8c76b4f4646d86f328ee2727d9a27fcc9a9f0a5ccc29cdbe3e3399312b420f56ee3e5a7cde717c70c2937d207

    Download Submit

  • memory/2216-139-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/2216-140-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/2216-141-0x0000000000AC0000-0x0000000000E0A000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/2216-142-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download