3b1e0422d152f65bf4ecef58bfb86282e83b4d1acb495cc5724fc3cb4243a3fe

Analysis

max time kernel
128s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CudaLaunch_Win_2.4.0-81.exe
Size

51.5MB
MD5

fb69944f37b969207c477960fed7608b
SHA1

2e2f41068875c4f67103d4e26847ad3bc8cb781a
SHA256

3b1e0422d152f65bf4ecef58bfb86282e83b4d1acb495cc5724fc3cb4243a3fe
SHA512

d589f7e1f6c17b6cac9cc218cfa9b9a5a5df57635347b21c9ccbee33c87fa1b602fed3f3ec7b31d7acca9a6e81eaca75d42b2c526c6d2eb1634a80574e0ff606
SSDEEP

786432:DQoHPVR/ycSoKsWTeqGGlfQp9TADBzzKJkwg4pCN6m+t0w2TZlPr8ZIDjDia8Dwe:UQX1HKfehGBAKakHbDlzZlz8WHDAwcMy

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1560	CudaLaunch_Win_2.4.0-81.exe
1560	CudaLaunch_Win_2.4.0-81.exe
1560	CudaLaunch_Win_2.4.0-81.exe
1560	CudaLaunch_Win_2.4.0-81.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1560	CudaLaunch_Win_2.4.0-81.exe

C:\Users\Admin\AppData\Local\Temp\CudaLaunch_Win_2.4.0-81.exe
"C:\Users\Admin\AppData\Local\Temp\CudaLaunch_Win_2.4.0-81.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy167F.tmp\LangDLL.dll

Filesize
5KB

MD5
30b091668111ab1d6c19f16586a9eee5

SHA1
aea49d81cf9972eaf1604793c04d13ddffe2c475

SHA256
331ca4b3a311324b463167ec43851146e57a2d90500ac3fd57a7683f6b777ffb

SHA512
6dd592af085b2e28c54d7f525916112dbf5cfe134393b0b97f8f1f64739cf90962273c51f02e8ce2c623cf6aa8355eacda5db0b0256d8f05a77ccf0f99d11648

Download Submit
\Users\Admin\AppData\Local\Temp\nsy167F.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
\Users\Admin\AppData\Local\Temp\nsy167F.tmp\UserInfo.dll

Filesize
4KB

MD5
a0efe0f3ef127dce9c59f407583061d9

SHA1
25ed3628daf08758870d0fe47f6997a9e97bedd3

SHA256
4506ff20ddc5eefb21d690e954f52df3da46fa47ec263ea965d86a683e74db40

SHA512
c403927a9def453a4fa031c7b45bcf202f0b4063f7dc39e3abfdffce3d663f3d7330ce70d8033befa6c45f7297ffd3f00d080a68d4c2611f8bd928d914e4881f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy167F.tmp\nsDialogs.dll

Filesize
9KB

MD5
d2e45dd852a659e11897df573832f381

SHA1
19990ee627c95b6c18d3b5c5f0ec5c24791d0af5

SHA256
86c8ee210e6611383a634dcb8c60455063ddae3d7adccbeacf3adf7bf2a46676

SHA512
93c9fa1767f3e861fe5765f2940aaba9eee6396d069c443ac6cbaccc88441b2bfc3c3af50a8044161f96bb7eb81af1bc6c1fa754d89740d0a2a8d591fef11073

Download Submit