Overview

overview

7

Static

static

3

246ac5ce41...JC.exe

windows7-x64

7

246ac5ce41...JC.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    152s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2023 00:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    246ac5ce41f1111e5b5a47a65ac5ff7a_JC.exe

  • Size

    4.1MB

  • MD5

    246ac5ce41f1111e5b5a47a65ac5ff7a

  • SHA1

    fc483970cb63ecad1aaecff1e88747f89c97295e

  • SHA256

    cbf8fdba8426d3b5d7540be5f55c13de824ee8a167f9ca9a9e1c1f2411e60f00

  • SHA512

    f63474b702e075cd1cf562956391e84800d8011dacf64319c0665e13b6abd30418c1f17b50aaa2f2faf6982fc57feae050f92d0c393be251d3507e1f6ac931d3

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSp34ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmE5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\246ac5ce41f1111e5b5a47a65ac5ff7a_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\246ac5ce41f1111e5b5a47a65ac5ff7a_JC.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\IntelprocSN\xoptiec.exe
      C:\IntelprocSN\xoptiec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:5028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\IntelprocSN\xoptiec.exe
    Filesize

    4.1MB

    MD5

    71360753c0e3278b96d45696ab3e96ea

    SHA1

    bb0a19c106341b419b6715a4f62a1d9a3c2ea211

    SHA256

    1f9b7b129a3e07a1a39c017cf0d32450badbc357d1e23dd09dc887a2256aecd2

    SHA512

    c8c3f9be7e7beb974ce1217b753bbb23af0b6254331dcc4be9c323a5c90b9d5ff38acd9f8ba719cbacd009f02262992b773eed4044cdbbaa10417c4554615a30

    Download Submit

  • C:\IntelprocSN\xoptiec.exe
    Filesize

    4.1MB

    MD5

    71360753c0e3278b96d45696ab3e96ea

    SHA1

    bb0a19c106341b419b6715a4f62a1d9a3c2ea211

    SHA256

    1f9b7b129a3e07a1a39c017cf0d32450badbc357d1e23dd09dc887a2256aecd2

    SHA512

    c8c3f9be7e7beb974ce1217b753bbb23af0b6254331dcc4be9c323a5c90b9d5ff38acd9f8ba719cbacd009f02262992b773eed4044cdbbaa10417c4554615a30

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    205B

    MD5

    84d705a026cafb06d30e34599575bfd6

    SHA1

    a98434d85fdb8b967b1ff04753d938492f9223d9

    SHA256

    94a3cc8c14176b7b456804b7ca4eca477753c365222675e1751c6da95aecb35b

    SHA512

    dcff467624ca553990ce2301d9f4603ad23a2e55454c6a72c97b12bff452838905e995d9353f279d20436c1322d128512a2321c5e0278fa32c81d9c03c973099

    Download Submit

  • C:\VidME\dobdevsys.exe
    Filesize

    22KB

    MD5

    cc51b3b7d209610f7a21f92f3b22e1e3

    SHA1

    d340f9fa1dce87346279c88d1951a44ae8a2a3ce

    SHA256

    6ae2d32ade74ce7d12c65077d60081010e1011e8a3aff6f70b42144fbb283a2b

    SHA512

    ee53bfc3287b9521ed72436ef4f8f763ec3d288c178bdedb22629440b3472ab7431c47027b83dc1dadb9c434f80a356aab24a536824210f7f94672b2946cd921

    Download Submit