Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
19-09-2023 21:57
General
-
Target
5bab80eda34ad508f34d46a245669920dbba51d665ce35fd85e3677e5eaf82b8.exe
-
Size
80KB
-
MD5
a779f5a538504029ae2fe3b3ba01400d
-
SHA1
360b85f82f03cfd81586b93fdd82ede07464bc24
-
SHA256
5bab80eda34ad508f34d46a245669920dbba51d665ce35fd85e3677e5eaf82b8
-
SHA512
a39ae08583df0c9dfbd1072757cd6406b0e9e633dd9961bb7617e9baf986e6cc2ef43776e85d3cd7d073b7ea9e42cc9adeb0ea6f86dcca6fb85a2a60c566685c
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOCMPR:GhfxHNIreQm+HixMPR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bab80eda34ad508f34d46a245669920dbba51d665ce35fd85e3677e5eaf82b8.exe"C:\Users\Admin\AppData\Local\Temp\5bab80eda34ad508f34d46a245669920dbba51d665ce35fd85e3677e5eaf82b8.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD5d0ddff76dc888a0ab09a82c669266a0c
SHA145cdea3c6a6092f571f0aa4549d40c35b75e34a7
SHA25667aec69da42b622fe4a43eb366e4612001e7e246a1355152bbdc5d51069de565
SHA51238914c7244c29383fe483e3089057d5ebfe0f1dd37deaa4c9013a06e089bcb8af737c0835ff722cb7dff6ca696336dd271ee4bd65e67deefe46639e5e959ac06
-
Filesize
80KB
MD5f518fd651ed363fb85cc4bffb6c02702
SHA1e7ebf290d893175cedb430e2c8aa4131abe4d19b
SHA256692237d8e4941e31c724128de14440247ffc804e8cef9576db9157065121b3b7
SHA51279ca1042b88d2d5368948e0f172d8ebf99ec5477fb5ce65aa37cafa5446fd01e7beae3bba8cb2a039ae82756a09e7c467f5a8c66ee465d61df26f0ecf3f9cded
-
Filesize
80KB
MD5f518fd651ed363fb85cc4bffb6c02702
SHA1e7ebf290d893175cedb430e2c8aa4131abe4d19b
SHA256692237d8e4941e31c724128de14440247ffc804e8cef9576db9157065121b3b7
SHA51279ca1042b88d2d5368948e0f172d8ebf99ec5477fb5ce65aa37cafa5446fd01e7beae3bba8cb2a039ae82756a09e7c467f5a8c66ee465d61df26f0ecf3f9cded
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB