41acabae83bee973d09be9fea79adeb9c6b3cf10c6181959b249552e8ca6819c

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d21db67b838d1c4b6fa2374f6b3b918.exe
Size

479KB
MD5

2d21db67b838d1c4b6fa2374f6b3b918
SHA1

688df05fbaa0f58aca760d5e0d97530a9e7503f7
SHA256

41acabae83bee973d09be9fea79adeb9c6b3cf10c6181959b249552e8ca6819c
SHA512

b873a60525b2c27a981b26f124ebe2003d3ada538601ba9000ba19e3d35090225b1c8b9f419f692985280f9b253de127d7ba41b89b581f2ff6b2f9f0a7da84af
SSDEEP

12288:nHO++IUBvCkfmvz756FGtkeSUknzp7tRuvftbObG:HxzUV5a75G0OtXggbG

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2792	2d21db67b838d1c4b6fa2374f6b3b918.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2d21db67b838d1c4b6fa2374f6b3b918.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2792	2d21db67b838d1c4b6fa2374f6b3b918.exe
2792	2d21db67b838d1c4b6fa2374f6b3b918.exe

C:\Users\Admin\AppData\Local\Temp\2d21db67b838d1c4b6fa2374f6b3b918.exe
"C:\Users\Admin\AppData\Local\Temp\2d21db67b838d1c4b6fa2374f6b3b918.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IM_92BA.tmp\ActionEngine.dll

Filesize
9KB

MD5
5b1793fb4b40fcbc9db9411a8183c004

SHA1
b8e540d0c92012c823babce8d799a8ed38a1e158

SHA256
7894416cd0d5b860722288f7a6fa54bec8e29c6f92d2c97999bbdc0329be38cc

SHA512
3f1737a3301c8602d8eed562f7ad9e9ed39bc584b9376792f73334ca7300ab40188e12028eaddc5fb43039b3c79723b84755d87dda4a05d63189dfa9d1ca21ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_92BA.tmp\ActionEngine.dll

Filesize
22KB

MD5
bc00d2822496f9ad864632fa6b55147d

SHA1
dd3c5cc830f8aaff4d521d6fd438b4b0bc6b0f8c

SHA256
a6036e4b3aa2a73655e7f01f987391fb1fe1c7654b819a810b982c9b62bf2a40

SHA512
7f95b1e285325980dea770c1c92ca4a85bce7c9ce30302074cf1166700fe2747a94f561471daaa8ba23fc85b1bbd0f123ecf3c6713912d459c2d3140580e7be6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_92BA.tmp\Gui\api.js

Filesize
5KB

MD5
cad20144ce29f20fecd6c21c5c61dead

SHA1
6bbaeb0aae32a3828cb77f8bfd3fb493803f3626

SHA256
e68cb263198cf8cf93e5a60be4ff091606be78b0963aca0e519732187ea93e80

SHA512
35e0f7c8cb13693d7e3a221f186bd72613544dc75e5355550bd0e7ed7054831258c5a487d20b412ce646313d24b3436baf10597baa8a359a319dbeee26580ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_92BA.tmp\Gui\jquery-1.3.2.min.js

Filesize
55KB

MD5
bb381e2d19d8eace86b34d20759491a5

SHA1
3dc9f7c2642efff4482e68c9d9df874bf98f5bcb

SHA256
c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899

SHA512
abb2ad8b111271a82a04362940a7ab9930883ecb33497a1c53edcdc49f0634af5bf5b1bc7095bd18db26d212b059aece4577f85040b5f49c4982b468fe973c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_92BA.tmp\Gui\jquery.localisation.min.js

Filesize
1KB

MD5
f1cf73e00c240e9a4283201291d45a07

SHA1
918c49cb6f1de521d91967b2508f19db1f38fea2

SHA256
81bce5ff1003c9d5a688102d5d4c603841ed61c32628823dc48d560ec0d42cd2

SHA512
2242892434a638a9344c87453c3d2a66a880278dcf66f1516f240131dca767248baf663ffc9365acad26550e5b20a742d8115d5976de3a094d0229d60844788f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_92BA.tmp\Gui\splash.html

Filesize
1KB

MD5
0d0e0532f51af856688ad83abb889fde

SHA1
a1949b703816fa1bc60cf9c395d6dbb0f6f5c61c

SHA256
a358150647aaf4413fd2738c8ebcc0579b0bd4ccca8ba02738a4332a430f8ec8

SHA512
29322e2446ae5a37a34f113be5924121ce7d8fcfc617818f59c407fe7da01153845a947464345d6b86463b18c75d0adae1cc7dd5f17cf2d29584ef9539d8e0df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_92BA.tmp\Gui\splash.js

Filesize
946B

MD5
354dce57695e99df9e6faba76346496f

SHA1
ca364e2daa4a80cfed7412b0f0374f1f82fa7146

SHA256
bb39b6b14ae7f032922366943b342f58be120242020b1fa4dbb3310e39928823

SHA512
8f34ae59e5502c70659e358d03709cfdfd01ec2128110932910e8de16888857896e86707c279b3f67edb54059a08ab6ce05b742342e825e2894580ae4a4639ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_92BA.tmp\Gui\translation.js

Filesize
6KB

MD5
682fea27f4c335defc18be6fb24d5748

SHA1
d4a1743d63508d18af4be59232f3d266228648fb

SHA256
928571317e90c4d6680931dffaaae85f382069be2bc72b875810ceb1f7c2744f

SHA512
ef70ad8c291fe10c8b1d0dc060fc50b4593cf6fabc03a751aa62d5f4e375b1c80184337816a8e50430964960fc56324259f8833707320c7b757e388ecbd28341

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_92BA.tmp\instlangs.xml

Filesize
10KB

MD5
5079352b83dbde9c4f61b8fd3e8ec9ad

SHA1
32b27be0c1b48f7343e40310d57a19ed161a6abf

SHA256
237b0eb09323852ab5c9a63c0867bb1d1afd831942a370f8629ec3586af55a6f

SHA512
1f67aca75c2ad98c867bc9f897100881eba20d0948a4cdd40ab7a74545ae3cefa687aba7cf26f87a3a006d84f52995793105a94df366efeefbe255b58e208b22

Download Submit
memory/2792-104-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2792-151-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download