20b78ad915cb7e3de3705ae4de67320fdcd388d1df60d7aaa3a259e19350b430

Analysis

max time kernel
34s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2d2c71094358590d6b56bb5ef7ff9c81.exe
Size

1.0MB
MD5

2d2c71094358590d6b56bb5ef7ff9c81
SHA1

e666fd7b429267afc6614721dea00c810ce4d2ea
SHA256

20b78ad915cb7e3de3705ae4de67320fdcd388d1df60d7aaa3a259e19350b430
SHA512

a63a2f4842ce97de05deb525be2136f3698292b77d2c89edab005b06bd3a3bc263148173c8485ee6addbaf96861303abb05027ebf7d5d91303934b15919d5bac
SSDEEP

24576:nGiiO5MkR74d6sWBgTfEg78P/aYxKctGB2xEso8hMiAw4b:qobR7MlTd8PzXte2isoCMiAw4b

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2900	2d2c71094358590d6b56bb5ef7ff9c81.exe
2900	2d2c71094358590d6b56bb5ef7ff9c81.exe
2900	2d2c71094358590d6b56bb5ef7ff9c81.exe
2900	2d2c71094358590d6b56bb5ef7ff9c81.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2d2c71094358590d6b56bb5ef7ff9c81.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2900	2d2c71094358590d6b56bb5ef7ff9c81.exe
2900	2d2c71094358590d6b56bb5ef7ff9c81.exe

C:\Users\Admin\AppData\Local\Temp\2d2c71094358590d6b56bb5ef7ff9c81.exe
"C:\Users\Admin\AppData\Local\Temp\2d2c71094358590d6b56bb5ef7ff9c81.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nss4EAE.tmp\LangDLL.dll

Filesize
5KB

MD5
0d0152760fd9457de1428bf906a1e4ad

SHA1
05230deced9421a0adfc29d449fbd3217f63cfff

SHA256
b44799188e62ea99e950031258be135d813d3b0238dd41f7a5bb9f295247842a

SHA512
6442775f18140b43e84b2fa017fe2f6a6c205b2de358eb5e5022a8c1bfc2503a071c39283f395fa4151d434343ce5d84fc4e65fa6e026a46a1fc93aae7609e80

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4EAE.tmp\System.dll

Filesize
11KB

MD5
bc3f65870d0587f6f7a4090232ee44a0

SHA1
b026d717e7a4febc9d4a54772229d1054f92a0fa

SHA256
8d6d45caf932f0ae15657a9909ba168a9a4f85f8e4384dc8cc28685cc4df2b50

SHA512
94efe8ef1de201d0e5ee518dc071cf1c08b693467b934ea1160f74a0222cdcdb4f66efc454743980e5df41a5ae932daef6857f85298899a292eb08d75dfbd178

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4EAE.tmp\__322bce84428d4b59bfa82b2ee0a7394a.dll

Filesize
384KB

MD5
6f9a922c2cf74e3dcc512aff35bb2d1b

SHA1
c5735b7296c750c1800ef9aa15a0e8c77fa680a6

SHA256
9d4db81bb10876c8ea5b01d0718ab334a44e457222ef230f2fb2051abad253d4

SHA512
bcd83ed67cf1a2908c8694db7c4e8d2fc19b25f3ee098be37ae407e75113c64b294d40201e469a687bd630dc72f0b367d5bbfc589c69cbe05d908fd08f4924a6

Download Submit