Analysis
-
max time kernel
143s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
15/10/2023, 15:00
General
-
Target
afc4d286b6199a9c8ac35cde8511656e64fc19d29497e8a4509e1612f1214c7d.exe
-
Size
2.5MB
-
MD5
4984d638b412fd2371a2934368b1769a
-
SHA1
3ba21d9895e7ce24f6b499318f8228ef7649e845
-
SHA256
afc4d286b6199a9c8ac35cde8511656e64fc19d29497e8a4509e1612f1214c7d
-
SHA512
385c2c9a4865aeaebded872ca7ae01705196c16bc82c2d232706762fc3ba0d9107f3f54de05b0d1445a5b29a70aea1d5552da27930b9840a2b3edc339064aa4c
-
SSDEEP
49152:hgFstei+6W2AJTqSvKRB/8+UOLmbBfj2DOMtE75O9K6Ud57YmrY:Ast5+P2AHH3gmJ9qKHL7frY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\afc4d286b6199a9c8ac35cde8511656e64fc19d29497e8a4509e1612f1214c7d.exe"C:\Users\Admin\AppData\Local\Temp\afc4d286b6199a9c8ac35cde8511656e64fc19d29497e8a4509e1612f1214c7d.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Music\xiao.exe"C:\Users\Public\Music\xiao.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
820KB
MD587a86fd4855daaad294db845d4f2242b
SHA1ff4859859ee6dcf4ef7502fa5c60a16d1712e1c7
SHA256672ee4ce9de7267239a12bfe5a09751817547f4136b99d60af00985a548cf3ff
SHA512d09fb93a6a89e46b556ed4b5d1b5a16bbd3e3fa2efbcb856df740aeda060d1f7168b01aafc3d560100aa391964b4ccf1df8888ee0ddafb0dcd217b8360d7fbeb
-
Filesize
2.2MB
MD519a45f5d5554890987606380b83893e0
SHA1ec6ddf2423e1def3deeae86556aa8b4c1ba696f0
SHA2569eee6bf121ec26849ad1be64b5fed73a840a17e572ce50b3485da81a88b3b7c9
SHA51220f61c351cdc889661c330e8b07fe079f96b99b51d13285884d56f159bbfe9cd7159125581e78bdf35bb9fa036fbd9be9baa1251a24fb2c8f2b401e6f3435bcf
-
Filesize
820KB
MD587a86fd4855daaad294db845d4f2242b
SHA1ff4859859ee6dcf4ef7502fa5c60a16d1712e1c7
SHA256672ee4ce9de7267239a12bfe5a09751817547f4136b99d60af00985a548cf3ff
SHA512d09fb93a6a89e46b556ed4b5d1b5a16bbd3e3fa2efbcb856df740aeda060d1f7168b01aafc3d560100aa391964b4ccf1df8888ee0ddafb0dcd217b8360d7fbeb
-
Filesize
2.2MB
MD519a45f5d5554890987606380b83893e0
SHA1ec6ddf2423e1def3deeae86556aa8b4c1ba696f0
SHA2569eee6bf121ec26849ad1be64b5fed73a840a17e572ce50b3485da81a88b3b7c9
SHA51220f61c351cdc889661c330e8b07fe079f96b99b51d13285884d56f159bbfe9cd7159125581e78bdf35bb9fa036fbd9be9baa1251a24fb2c8f2b401e6f3435bcf
-
Filesize
296KB
-
Filesize
2.1MB
-
Filesize
296KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
296KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
2.1MB
-
Filesize
1.1MB
-
Filesize
2.1MB
-
Filesize
48KB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB