Resubmissions
04-09-2023 00:33
230904-awfdesdb38 803-09-2023 23:32
230903-3jc2rada36 803-09-2023 22:36
230903-2jhrkace5s 827-07-2023 15:08
230727-sh76dsgc6t 1027-07-2023 15:03
230727-se9vtaff33 827-07-2023 14:59
230727-sc3zgsfe94 8Analysis
-
max time kernel
591s -
max time network
449s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
04-09-2023 00:33
General
-
Target
Castle of Temptation_6hiiU-1.exe
-
Size
13.8MB
-
MD5
98f37b09dadc616079b92a6c5afdd066
-
SHA1
b55932b9c10046cfccde0210d5da29f3e5b2afb9
-
SHA256
1f4f7b787ee329059e4de4487ba5c17c7c6ca3be95b72c9873fc9380632fa1f9
-
SHA512
6e45a6fe9d35350be799fa95d7aa12a960695d94dd99ff581c17685b94c1e8b4ba618dc5d3932a7e0ce63c676471caeb6bc2ee40e1c644ae7848bf0db286a26f
-
SSDEEP
196608:0j6kU9NYlObEk0Lp2dd/kZzkmxgy9NSW7I7GIXSpINbhiTGIwTh3kC3uDEN9TrSh:mLSN30LpEiSCC9XSpIFwah3RuINhkUU
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Castle of Temptation_6hiiU-1.exe"C:\Users\Admin\AppData\Local\Temp\Castle of Temptation_6hiiU-1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6JEOO.tmp\Castle of Temptation_6hiiU-1.tmp"C:\Users\Admin\AppData\Local\Temp\is-6JEOO.tmp\Castle of Temptation_6hiiU-1.tmp" /SL5="$6018E,13603942,780800,C:\Users\Admin\AppData\Local\Temp\Castle of Temptation_6hiiU-1.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5669677fda69fad1e66ff28fe36ec5fba
SHA1ce3bd4be74b75747e53180d283aaeb46a661da1c
SHA2563f400a7b565cad7a3a7823e8dc24942f965b062a67f6a212cc5a2b256c85b096
SHA5124e1940f56f7f314bf7c5d459f48a935bea6271c74cacdbb4e0da0bb18d52239c5b867d61a2849ff146a29f2557c2fa4921767bf1b8bd697eefeebe43d3b52d19
-
Filesize
2.0MB
MD5c79e3df659cdee033a447a8f372760ce
SHA1f402273e29a6fa39572163e4595e72bde3d9330a
SHA2567d09715c4e0735a0832bf81d92d84600df1815a2ba451586bd25eb16f7c450a5
SHA512490cc30ccfac209f1f5332ce4168b0dc849d7e4d86f3c198ddd23b39ddc950001928a1e071c2ace74c4710508265c0872adb02e3f068e521d28ed8b19ea36492
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
4KB
-
Filesize
816KB
-
Filesize
816KB