Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
-
submitted
27-06-2023 19:58
General
-
Target
2c4a76422b8397ba90df1176ed1e2d79832ab07becc4303df0c8e2d1897302f9.exe
-
Size
64KB
-
MD5
766c89eaafdcb9c29c894cb2cc4af201
-
SHA1
5f9ca7cb9e333c13e5da58ecb010fde832ae5cb4
-
SHA256
2c4a76422b8397ba90df1176ed1e2d79832ab07becc4303df0c8e2d1897302f9
-
SHA512
7e45f05fcfdea217cc5f28c194f4f540ca39b0ff17a91a993880e82884c25788b0cd7c6cdaeba0cf0666eb628c647040e77fe3d31d03bf6ebaa9159c378518ea
-
SSDEEP
768:qp3eEneZl1k3smLIpXS8Go9Ql/aFCPiXfXweaVU4CNHN2g:qteEnsqDLIpXJX2Ot2g
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
NTFS ADS 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c4a76422b8397ba90df1176ed1e2d79832ab07becc4303df0c8e2d1897302f9.exe"C:\Users\Admin\AppData\Local\Temp\2c4a76422b8397ba90df1176ed1e2d79832ab07becc4303df0c8e2d1897302f9.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\ProgramData\rundl123.exe"c:\ProgramData\rundl123.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\sysnative\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\hdz_121344.dll,StartHook3⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5766c89eaafdcb9c29c894cb2cc4af201
SHA15f9ca7cb9e333c13e5da58ecb010fde832ae5cb4
SHA2562c4a76422b8397ba90df1176ed1e2d79832ab07becc4303df0c8e2d1897302f9
SHA5127e45f05fcfdea217cc5f28c194f4f540ca39b0ff17a91a993880e82884c25788b0cd7c6cdaeba0cf0666eb628c647040e77fe3d31d03bf6ebaa9159c378518ea
-
Filesize
118KB
MD530614822f2c117daaf5b58538c1aa638
SHA177cfc050caecd55cae522e5d53ca3d069763fac3
SHA2560f7f7d2da7dbeb903acdd66391fb0cbcb748de68607746db4265277b6a240ddb
SHA512005ed3f1599bafc84faf5c162eddff01f662d52d4b4e47bf18fd203b15efeeac11f9972d4e4926013bbcb2f9816bb536d78a37cfd49f6fc1322676fe37b27c30
-
Filesize
118KB
MD530614822f2c117daaf5b58538c1aa638
SHA177cfc050caecd55cae522e5d53ca3d069763fac3
SHA2560f7f7d2da7dbeb903acdd66391fb0cbcb748de68607746db4265277b6a240ddb
SHA512005ed3f1599bafc84faf5c162eddff01f662d52d4b4e47bf18fd203b15efeeac11f9972d4e4926013bbcb2f9816bb536d78a37cfd49f6fc1322676fe37b27c30
-
Filesize
118KB
MD530614822f2c117daaf5b58538c1aa638
SHA177cfc050caecd55cae522e5d53ca3d069763fac3
SHA2560f7f7d2da7dbeb903acdd66391fb0cbcb748de68607746db4265277b6a240ddb
SHA512005ed3f1599bafc84faf5c162eddff01f662d52d4b4e47bf18fd203b15efeeac11f9972d4e4926013bbcb2f9816bb536d78a37cfd49f6fc1322676fe37b27c30
-
Filesize
64KB
MD5766c89eaafdcb9c29c894cb2cc4af201
SHA15f9ca7cb9e333c13e5da58ecb010fde832ae5cb4
SHA2562c4a76422b8397ba90df1176ed1e2d79832ab07becc4303df0c8e2d1897302f9
SHA5127e45f05fcfdea217cc5f28c194f4f540ca39b0ff17a91a993880e82884c25788b0cd7c6cdaeba0cf0666eb628c647040e77fe3d31d03bf6ebaa9159c378518ea
-
Filesize
312KB
-
Filesize
308KB