Analysis
-
max time kernel
155s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 14:38
Static task
static1
Behavioral task
behavioral1
Sample
aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7.exe
Resource
win10v2004-20230915-en
General
-
Target
aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7.exe
-
Size
969KB
-
MD5
5f4fe30f98d341dcb6ed7af042f10751
-
SHA1
371827943671245563fd9e702d0f81094066c1d8
-
SHA256
aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7
-
SHA512
a9ba60d53b3b7369dbe6b1b94bb9c29f4880bf23e2f7dd8e05a9d6d0281000eeefafb97bb7d3db4e242e76f659cbac7330e016b9dc034c81f7403e052b2fdda6
-
SSDEEP
24576:kVMz3mFedVMYMSoOSn/R2VEKICX1/uQig+SWS:aMz3mFedVc52VEKICX1/uQmT
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4236 2023-10-12-2110.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\CitiesBase.dll 2023-10-12-2110.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4820 aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7.exe 4820 aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7.exe 4820 aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7.exe 4820 aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7.exe 4820 aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7.exe 4820 aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe 4236 2023-10-12-2110.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4820 wrote to memory of 4236 4820 aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7.exe 87 PID 4820 wrote to memory of 4236 4820 aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7.exe"C:\Users\Admin\AppData\Local\Temp\aad2a1a8f2d1d2ad22d88f0e25062f8eb7c30005b1c8d33e3bfa602c6fbe54f7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\2023-10-12-2110.exe"C:\Users\Admin\AppData\Local\Temp\2023-10-12-2110.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4236
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
976KB
MD5d287a32a29827150d2c189e9d645688d
SHA1ffafaaabf3e1376ee351980ef87154a0316df2b5
SHA256bb152b42a5d316ffe21614ca1455483d0d49b46196db050caa9f71777505aaf4
SHA512628822c49b524d885838725933141a60982fd3ee7d948edf0567f56946bd51f10b57fe0032db77c7431a699f4396f03dbe54b6e7639d44b2a7b2240a202044bf
-
Filesize
976KB
MD5d287a32a29827150d2c189e9d645688d
SHA1ffafaaabf3e1376ee351980ef87154a0316df2b5
SHA256bb152b42a5d316ffe21614ca1455483d0d49b46196db050caa9f71777505aaf4
SHA512628822c49b524d885838725933141a60982fd3ee7d948edf0567f56946bd51f10b57fe0032db77c7431a699f4396f03dbe54b6e7639d44b2a7b2240a202044bf