Analysis
-
max time kernel
142s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-es -
resource tags
-
submitted
05-10-2023 13:20
General
-
Target
DQHV_Fac5467turaMGVGIYVGIEYE.exe
-
Size
111.4MB
-
MD5
8ca18f31db0e5051f432050162f94cfe
-
SHA1
e253a86c409028ffff9eee91290b32d928be406c
-
SHA256
ee16ef68cb18e216151f6348a36c785cb42379647e8f2028746850b405d5e342
-
SHA512
2945e64f03e669750534b215e8c9969f012981e5c8677822b90834de829d4547b0334d527825f08b6a8a53afafbb04e69868d19bce8188e88140d102bd4640fa
-
SSDEEP
196608:YDrr+RXNIIaG0t7361wZ8RNWqRXXmYgz1NW07AkH0GJv4+n:crrgdJa/3FZ8RNWOXr818CfJws
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DQHV_Fac5467turaMGVGIYVGIEYE.exe"C:\Users\Admin\AppData\Local\Temp\DQHV_Fac5467turaMGVGIYVGIEYE.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
16.0MB
-
Filesize
1.6MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
1.6MB