Analysis
-
max time kernel
143s -
max time network
5s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
53cb591edf40ab246f08ca516e3a605f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
53cb591edf40ab246f08ca516e3a605f.exe
Resource
win10v2004-20231222-en
General
-
Target
53cb591edf40ab246f08ca516e3a605f.exe
-
Size
313KB
-
MD5
53cb591edf40ab246f08ca516e3a605f
-
SHA1
28569ff37ba592a0bf7903770af1904e8c28b88a
-
SHA256
24dfc4dc10acf21fac34b5f8f5519d71074a548a18396829a700e9488551bcff
-
SHA512
aef93a4af3be0262c3eb624980c1d443974afde21394b6b4ff223c4e2533d69448c4e45720cc8ef3abac4d318410a10edc6bca559aa374d2cab58e57a62d03bd
-
SSDEEP
6144:grJ9uEo2S1YnQmCX492DkwNP3qpYFQiY0Z56GICaNRCVEumbcF6ov5d889PgLVDb:grfu6/eIo4jVW5soVCcQovoO0DJM+EE
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 4440 53cb591edf40ab246f08ca516e3a605f.exe 4440 53cb591edf40ab246f08ca516e3a605f.exe 4440 53cb591edf40ab246f08ca516e3a605f.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 53cb591edf40ab246f08ca516e3a605f.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 53cb591edf40ab246f08ca516e3a605f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4440 53cb591edf40ab246f08ca516e3a605f.exe 4440 53cb591edf40ab246f08ca516e3a605f.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD54e3e5ab4014079bafa9aca62c87e3888
SHA1b7f378845ac40483e3be6c161da8cb1102559d2b
SHA25639e066633cad5d1e1e8ac16ec9caa23b3673b77c7a80bdf789eceb276223ae07
SHA5128025bd1e79954885a0547f23aa506c95511cc4b2188699f18786ea9e8520d9b2988f65b4fa8d571c7d0abbb2ca23451b873e43b483459a8d1c800da08c1531fd
-
Filesize
48KB
MD5f5e78af7b2bf79839795aa7a003e119b
SHA1b8cbcdabd59566e36c71c7330d5e9dad0eabd3d0
SHA256ebb58249071419c047a404cd46e57b41d739e51a3ee8dcbac835a1e9a7e83557
SHA512617407e7ee005976a92bffac5c4bd4782a47531e33ae1b2d550748d81b8f6ef743b6e19d322ea4b84e0c08183b7ac1f6049ffaf3b62803c8cde0ebf2c7bb77ac
-
Filesize
23KB
MD5c4e95d608aea753f97897101fb74dae7
SHA14dd1cb27a95c96003188840b9647b458d4c00702
SHA256ce1f745d9c024d4ca02684f261334cf733ee4cc2837e615f3e8bc41a54bf445e
SHA512f7a885538eb23f6123588883d99bd401cdecb803ccea380827f5fed91a3470f4f625e219c78e2a7c6c00b5e684475c3260fb1c5f23a3c8e1bdbbe8a75687e85c