Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
19/12/2023, 15:34
General
-
Target
ee1068c.exe
-
Size
20.2MB
-
MD5
e96ea3951a03b5debc4ba93248752a50
-
SHA1
6f841a37abecbaec6cfd2d86a19829739ddee29b
-
SHA256
d85a2ee10e15056a66a15e54236ac52406e9a8c3f706a82c4e47ea383ac341f8
-
SHA512
906c162610430d9320ebb845dd2b925c1b3492d62310968221053deea6949ca3527715d13d551a35092aef6814320859a2da3bf72a2283044ab6ebe917e097c2
-
SSDEEP
393216:tfue7yaMyDnEk+hn6AgU3E6Jk9oXW3iLjOFmwF8DIsLjra:oe75M/J9EfGnmzF6IsLy
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee1068c.exe"C:\Users\Admin\AppData\Local\Temp\ee1068c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NENC6.tmp\ee1068c.tmp"C:\Users\Admin\AppData\Local\Temp\is-NENC6.tmp\ee1068c.tmp" /SL5="$70124,20339386,832512,C:\Users\Admin\AppData\Local\Temp\ee1068c.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\RedTitan\software\ESCAPEE.EXE"C:\Program Files (x86)\RedTitan\software\ESCAPEE.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Program Files (x86)\RedTitan\software\EscapeE.exe"C:\Program Files (x86)\RedTitan\software\EscapeE.exe"1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\RedTitan\software\EEFONTS.EXE"C:\Program Files (x86)\RedTitan\software\EEFONTS.EXE"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD56a6fba47ed69b5df65185a3e10124e9e
SHA18da496a70b2382f7fd76f6d28b7f141a263d2fa3
SHA2569c87f8eaabddf005eee1f63160236580a54b6f9352b17d211ce521876db1ba1d
SHA512121febf755ebe79873a588d54f02934208518b756a61b350957282d18a45917b6453a8baf109defe391d3a65bca21af9f9ff238d07361deb1ff4b500b494ceda
-
Filesize
2KB
MD5e6b3bacfb22bdd71f57a1414cd0c0299
SHA17b971734eb412565c2a5576c570572bd060e237c
SHA256c94bea6860aac8ea8ccb3bd945091e8e96a4baad49f138101a05ffa2b9d58b37
SHA512b0b4bd164a7429ca0734680d8406557bfbdb53543d6096134cfb4409b5050e2c1017977c9af1ebfdaf8c94a92216b3d9200338c97ee089209177ff25730743da
-
Filesize
313KB
MD596d291f3b17462fbb3a0dbf8af7722d7
SHA149a4f8714340e6142ddd353490e0a81211f009a5
SHA256b7c86dd3abbfd9d8b3758c4986057046086b300aacc2342dd70c6f064a78f8cb
SHA512feba6b1d3320cad0ef0635160009dc14c35c0a8332359a4bebdf4e62520c77be7ab274878a42d9ebc936adcdbcc0553896d11722cb218fcec454822cb600bc5a
-
Filesize
161KB
MD55225ed54da4aa8d51258882911c29920
SHA19f3733f75721df470a7452b6d83c6c7ec1d826cb
SHA2561aef43b51da25681b45e5602ea8ed9580ee5dfa122276c1bd9121992723e5b8b
SHA512198b40bfa08a759c907c2e45c44e418bd25fc0bc95b119d9669325fd6a98bdf2812a5ec0c726b45dd4e210b86eaa02f36167e035f2b466f70be6b07108f795e3
-
Filesize
16KB
MD5aaef0029a7b233df7d9de901f8aa11b0
SHA10392365cb53b2986593dfb0a52299a8dee1813d2
SHA25630985ef7a235052701f8eb82c6d7617d8157a776d0aeba1de46f18d200ce0af0
SHA51216fb9d30e7c1427b53701d1c98876ad6950e9f429eb826b55c6db946e2d859304932e259919c301eb304a03916ef852bd9687fba0d064648992ce878a7147b47
-
Filesize
12KB
MD5e416dce9ea030585a30dc54cad830d51
SHA13ebdf57531390f79e8aa0c62cdc2702e97d85b89
SHA256c748d9f572b2c351e6bfa2bf85b3fbb0971d49b5327c202592938b325ecf08c3
SHA5123702213d640163ccd5352629605b1557710c1c643247cc292101ced4126d7cfd24f43e44abca134a8648c279838db6dfa0acd4a828099d41d628b24e9b1ed81b
-
Filesize
143KB
MD5875368777dc842de7ff30df4688c5bca
SHA1cfdbffbc7eb9f886c5ef4e6b77915ab010bc9464
SHA256d535bf29a50f8e37568a2355e74034523b53c218485ee7595520d3b06661831e
SHA512d5438f107c590b86fded8d458e103e1cacef779ba7c084e30f047468588cd22fb4853608789a2f2f0498255de2de1c954352656f1fc9af8dbebfc34fd203f551
-
Filesize
17KB
MD5eb2b1033260bd76de503cee89e642466
SHA1739963d57528a0deb5cee03feed618d7934593c2
SHA2563d62d76a50ee39ab2980bd3e05931d90275b82ae390786927a52ef2a49fba8e3
SHA512562ac8de2295558bb1f67471375658532ec93cb6ab5df5973c56d2b0ef7fed43a2b168ef46c2bc00fc041f2e66a039d99dcbff3a7282df45aa6be892be151cef
-
Filesize
798B
MD50c86ea650ab0fcfbae16da115c87faa8
SHA1196403010ebf383401a7908c7b914bb67d5013ca
SHA2567125c86275f2cd00748fa4b02c7302b84aebd0acb6b8b9437f9223837339916f
SHA512d30351065c122346b89b78a0edbd1b15d0edbaf6fddd85f5bbda141316a3eb20b7220208fe3444c60e2b11fb6ed687c65a95f1969633bc1f9495ca31faec1f82
-
Filesize
187KB
MD5757102e47701bf96bccf7735105b80aa
SHA15a8dc07375a605e541f183922ebddcc96642d36e
SHA25650aa136d2d2d4266cac252e7467accc9c7cfffea996139b55b814c826ab96993
SHA512593e54dbfd8482b4bb28395f7c5412dee2d3e332d0d75f59c344283ba6e8b2ebfb24d80669a685087facac426e5635cf44ab87b65b3480ecf31fd2f59e4cced7
-
Filesize
501B
MD5a513543f4a1281b5de3360e1fe4f28d3
SHA16304cb02a5691a2010c58676ad2391b401a5a25c
SHA256afe93f9a839ba3b6b426b78020401ccc6b0c8e435e958aa8858474d5497fa09d
SHA51247fcb78ee65c54278a67c9112fea262cc3c299c008200f115a1a72bc0bc9421d03885646b4f24f85cff87d0084c7dd22f954f47ddef566442da03adc56283be4
-
Filesize
559B
MD5be342452846564c0539ffeef34987610
SHA18d17564ce165004ffd014db5efcaea0908ec52b1
SHA25686b9c200e9163aa6b0ac50d39709072f7bcf9b78be911e9b00662b1fa643eeec
SHA5129673e59fdae3ab1124a1b72281e21182cc5701965be0558230b442cc323667f86d631710da8f779ff1a468cdf114efe1b551148e2b08216b41d4343c8abcfc52
-
Filesize
216B
MD5e98e209afab8b75cd83220cc7a1ed3c1
SHA16216443c481d85d40dff6d43fb156a372fcf1938
SHA256b754c0f0813f45ce14c3a310a0585c2a80e1da975898c1daef60c1497a731d43
SHA51262b6ffd19e6932204dd3f539db927565836eaa29294b47a52526d871aa00aa45e9f4e1b3771ba55e1930880315db0a255b1ba9f2ac97dec50abb34c25857026f
-
Filesize
335B
MD547e08bef5bcc5f355a744683e3db6f3e
SHA1414ae4abae700cf9cd8d75dcf56a30c4ae188b16
SHA256d8745da5d134b9f14ead9ba33f540c19cd724e89b9cdab790408293657d054bf
SHA512cce9af149da66ad12cc5984374c12b173179eb45e4efe5398e7d89fcbdf4d6a4b39bedad40b3e8ce3f15f21f11ff78f1b4740189e2126b95f49769267b170f9c
-
Filesize
394B
MD58a811171ccc8710e9da80d476672ae91
SHA1f8edfd794483976899b3228f8e2d448cb268d982
SHA2564a62844d579c4d56e985ec48020c06be0ed82989fc8efb48a6f86c9dc3c86ebc
SHA51295d9e271e738ab386623af1147b828ae1f7533bb03dfff9fe2d9b76857f92a14b881e9a6f215ed0b588b99f718fb9be5e1952ace82397da66f18e4aa754e0ecf
-
Filesize
551B
MD52f01abd1c4e68c0c1e599212054ec597
SHA17bf3b2a41787007cd2d3a871d3c277753aee3c53
SHA256278cd8ee9b8b5a9126c7a5bd5942c3bc01387c7c1709c53ede0ba8840afb7a0a
SHA512e3b5dab4667ee91efd983a7a6a378b74e032bb27bfcb9bc2225ae802cec1b66f414aee3188001772713da7fc86c7031c207d80f339bedc2904fdae77f293b1b4
-
Filesize
637B
MD51e503a15aec14b4ec667c51e484ab1cc
SHA1a6d7c032409fb10637008b740ed4b0079a82935b
SHA256c87bcb1a4405f92b6b262cd206f09bc269d9f12f40b74c643afe239d642b9995
SHA5129c815a7b7455747c2884d35209df7a90ef8bfc59a0748ff7f4a53c1a6055b5e0e49f199ed98dfe8b95aa0ca4037dfee5dcd9f2c7d31118658b9c21f9efb66000
-
Filesize
834KB
MD5283d509e47b3a770ec0217d6c569980b
SHA1e135e4a249f258c11bcbbd04dc7d43a22b0b9abe
SHA2568b4fc8be58234433a233427a1b7e241abc690e93156891051cf5225691842222
SHA5125589fffd4ce3b3c25864390b7a47e9b128686aafe858f422e1f915888b06894925c8995b9b57cced0cd245fb6a44770c1909ec6fe48765d262373355cffe7c40
-
Filesize
3.1MB
MD5683d1524110c6d696cca3c56d1527470
SHA19c7740dadf5b9d42a9480727ec7669279fdf4bc7
SHA25686f795030c7e9f905432ecfb3a172d7fbcfe549dad46c785c72427fdfda63ec1
SHA512b0913cda7285b3b2a7d5bbbf50fcf947d0b4b5cdb25a5b283f0df69f76e845c4ed86a49115883e19df4aab0d139973a561c10c5e3d29b13e626df537c37e56cf
-
Filesize
119KB
MD54ef5e9d792e9438af7845cf9bac47db5
SHA127e4177c6c453238724652ab0ad76fcb31106273
SHA256be6539315b77982ff466bb923d9628c07c0f2f514c08773a16cf66b2d8871b9a
SHA51246549314a4913fdd640ba654760a3d919d6ddfb62614303358cca2292ca7760568caf661b1671e8bd10355b62084ae13b8444b98074e5f5a7708a4c9b95053ff
-
Filesize
115KB
MD54bd30b023b807e13c06defc2d25fdcb2
SHA15d10c9bf905e1090ab5ea95fa532e1e27c1042e3
SHA256f80ecfe3ccf5a33f2b8c9159052d11601fb380ddc09a5e306a078e31ca99675d
SHA512941b5c77ce3d78979dfe63cfc7cb26291095511efce4fd59c2edec9b35295f009e29526c2578983b71edb138e04baa7c8dff5a8ece85889da6588a613e0c5307
-
Filesize
679KB
MD5a740e9df3488d0ce4a1940fddbd0f255
SHA148d959baffd4019c2f47a2e5415248302142687f
SHA2568133b74d9cf12c8a504dab3bc30fa847a6e05ab2df6a016bd22696627e3ae8eb
SHA512aa9e71d88fc3e42e80decd80813d427a30c395ec208b2f585f1e5ebafb378055755d33ba083196ac7688c933487683f00e9b34f92ec5ac0fc86d31da94ab1274
-
Filesize
113KB
MD5ae95a58ceafc0e14f626f5f20be238cb
SHA1ff4774a463f66cdf4c8fd092815e5d01cc7aadf7
SHA256eb13435b26ff1792d7d9cd480e8dc2f9cb9bd33ae7e568480533bec74283d528
SHA512bc764fb190ddd57d8b9a83280f4b50f407be79f82def48f5efb52d8352b34b03d90eea95bd0845e5ec15bba414a3d3f1ba91ebac21f7e2a199353680e9a9040e
-
Filesize
3.0MB
MD5caee599d672b654c5d6ff6ccb7690c4e
SHA1ec99b02fee1eb458b399ce384a8f081f9373d2a3
SHA256cacac72b2a294954adb669fbc60d1c3fb4b0f5a253e1d200dc28f22f1f927238
SHA51206cf546ebdf4c559e9b71e4ce1a889a0c16aabb6e2d123b41a60e0ae65c24fa4e5fd62f6fe37b089f81df40e01ac2bbc6a1c7da494b4e1592012439d0fed1448
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
140KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
852KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.2MB