Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
25/12/2023, 08:59
General
-
Target
1388d2341e92127dfa45e430ccaf39ea.exe
-
Size
1.0MB
-
MD5
1388d2341e92127dfa45e430ccaf39ea
-
SHA1
9f57b33e484997daea38700b2722935cecaccfa8
-
SHA256
55ff30c07971eb38976e968567f399606ff7fde185ccb6269e152290510e1d5f
-
SHA512
636750cb93cd34dca5ecaeeac71b4f57adbc41ffdb0b0f3a71cd62ea98c08110f341d27ab136e5699143310a5f812bd378f47fe790914523926811e2367d1018
-
SSDEEP
24576:pMM7OWkMM7OW40DBq1PXTvgUB7OWjxpV7OWtvr6eYifmgiH59KgwpY5D:pM3Mf0spjIU5b6Qfml59Kgw2D
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1388d2341e92127dfa45e430ccaf39ea.exe"C:\Users\Admin\AppData\Local\Temp\1388d2341e92127dfa45e430ccaf39ea.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~sfx0057E23EE3\gooinjector.exe"C:\Users\Admin\AppData\Local\Temp\~sfx0057E23EE3\gooinjector.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
865KB
MD5d9848a40442b633a91739bc2b40afb80
SHA1b7cc75c291681b2a1cbabebc440e62a1a3f4fab2
SHA256410c6465eea641eda84e8f1c861d06b59e35da50e4d88e2e6a9e06b90bd773cd
SHA512efe1d32f7ca3190d24c027b02e22902d68e685f13fa2728669e60e87abbef5afd93bd5a385472ec1a44a91810f1c382da100fc90df1bea7bb28c0407974a7e29
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
888KB
-
Filesize
4KB