Analysis
- max time kernel
142s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
17/08/2023, 06:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AUGUST ODER.exe
Resource
win7-20230712-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
AUGUST ODER.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target AUGUST ODER.exe
- Size 310KB
- Sample230817-gwf4aafg86
- SHA256 b6b2b89e880bddb6817fc3da22e4cf9a0e6f823667f8d3eb5de2e8943f745405
- MD5 e76a64c4d5b2e65dcdde22d47f0c6cfc
- SHA1 7443d7ea37eb5992a264a9dbb4bcb4b81df1e0f4
- SHA512 50691f99c28a9bc23bbe7b8e931d1bcd71ae95b42816f71dbe8aaf74cce70cd51752a5c39e1ced5091842b2c43d6ab1d35d5fa3964f3141eb5a9e6d0708af025
- SSDEEP 6144:/Ya6GGI+f+dvDN116rfEQk/f5tko1oPii2g5GI3/j9uQe4nVLUMwURfoikN:/YIGI/16LqtaKi2g5GIvj9uanVLPrRZQ
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3700 AUGUST ODER.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3700 set thread context of 5072 3700 AUGUST ODER.exe 80 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe 5072 AUGUST ODER.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3700 AUGUST ODER.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5072 AUGUST ODER.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3700 wrote to memory of 5072 3700 AUGUST ODER.exe 80 PID 3700 wrote to memory of 5072 3700 AUGUST ODER.exe 80 PID 3700 wrote to memory of 5072 3700 AUGUST ODER.exe 80 PID 3700 wrote to memory of 5072 3700 AUGUST ODER.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\AUGUST ODER.exe"C:\Users\Admin\AppData\Local\Temp\AUGUST ODER.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\AUGUST ODER.exe"C:\Users\Admin\AppData\Local\Temp\AUGUST ODER.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nssB3F0.tmp\lrjld.dll
- Size 86KB
- SHA256 a6127d83f52f428744402cf160969ee71ded617fadaa13a15c9d1c62e372963a
- MD5 c0fb0873781ac6f51a3bb865461f6dcf
- SHA1 65ebea7373197e2fcb0100ff9552430b997bcf31
- SHA512 bdd09ea9b0d7eb07f47bda8c61ba917eb483eba29c3bc907b108d1e416ea49e0f8a5f9fa31391646ae8670ce632a52d63bff11b44ad669009605c6f320c0a953
- SSDEEP 1536:rqK6tA+BrbP1ATlcm/GWneYp2C8TUH000yoh8FihG7lsWkcdb1YeEaiZp:rGR2TlcnWnkTUHAei0bGeEpp
- MD5 SHA1 SHA512 SSDEEP