Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
14-10-2023 00:52
General
-
Target
55749c84a7fa0d7faee8a4bbd4cf19778fd0fd6096729bae15286e169c714e19.exe
-
Size
78KB
-
MD5
b5be93e3a3b753d34a15d2a524a0c6d4
-
SHA1
55587f45928cb57da0b60ceb91b57e80b0df0d2a
-
SHA256
55749c84a7fa0d7faee8a4bbd4cf19778fd0fd6096729bae15286e169c714e19
-
SHA512
45914a19ca75840367ca078bfaa7e518edb58a166f402e91eb00725871c8420d6227f3900c909dd059a34ee116ef728e4b8f4f6e8e3ff346f0637b71485a804d
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOMpy:GhfxHNIreQm+HiJpy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55749c84a7fa0d7faee8a4bbd4cf19778fd0fd6096729bae15286e169c714e19.exe"C:\Users\Admin\AppData\Local\Temp\55749c84a7fa0d7faee8a4bbd4cf19778fd0fd6096729bae15286e169c714e19.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5b7756d69a698bddabd5a1cb59ac7b139
SHA17117ec11433a3b95de678092c761c36055d36e85
SHA256114d18911cc0197f156716047c1201ba0944f200d9c06d68030175961568507b
SHA5126ad6db67dcf9f9fff20953f0e20eedd990a61ac528829e5fe8f456cf1c749ba0b6c7498f18701c0bf0f57ae1bd0c2ce42f3fe1c43ff9eba6e1ffad07f5d79cf3
-
Filesize
80KB
MD52ab75106da0625d3d3061269158d5152
SHA1242b667068c644e3a9f5fac9b636fc6996961900
SHA2569353570e2421abbdba50a9f6de4e47e605495752b03fdf770d91f6b9ebae2f40
SHA51211d19716c86866d0773916300334b28791faa4395380ba9162e3a98f1263845972fb8729d20caa99f7f9b2436f37b52aaaa58e4e16c7ec8c6c4f8441a4cf3d9f
-
Filesize
80KB
MD52ab75106da0625d3d3061269158d5152
SHA1242b667068c644e3a9f5fac9b636fc6996961900
SHA2569353570e2421abbdba50a9f6de4e47e605495752b03fdf770d91f6b9ebae2f40
SHA51211d19716c86866d0773916300334b28791faa4395380ba9162e3a98f1263845972fb8729d20caa99f7f9b2436f37b52aaaa58e4e16c7ec8c6c4f8441a4cf3d9f
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB