Analysis

  • max time kernel
    181s
  • max time network
    213s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2023 12:45

General

  • Target

    6f8547738b5416d5183e11e78b4e6134.exe

  • Size

    304KB

  • MD5

    6f8547738b5416d5183e11e78b4e6134

  • SHA1

    cbb4ce07cef16b72218b1bf6f527a4d775dfde50

  • SHA256

    04616c7cb34b88062545dbb9fe5baf92ab5f3283c740aea29db74e14a7d12e32

  • SHA512

    344937afda732edcf6f61bc9d48ced628c966bcb78fe23a125e31bdf15bf153bcbe218fa794d3614a507225adb9affd9d61828ea3b7a7e1176263cee4fc7d8ee

  • SSDEEP

    6144:drkx9uEo2S1YnQmCX492DkwNP3qpYFkXdlP5IO5/OoCVHuy6SHZ86riVZkiizk:drkHu6/eIo4RXdrIO5/OpVHd6Ky6riz5

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f8547738b5416d5183e11e78b4e6134.exe
    "C:\Users\Admin\AppData\Local\Temp\6f8547738b5416d5183e11e78b4e6134.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:1844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TsuF657574C.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • C:\Users\Admin\AppData\Local\Temp\{85A3412E-3CE0-48BB-AA50-74C25E4063D8}\Custom.dll

    Filesize

    73KB

    MD5

    e8d86c771d7e23b080921b9803f1654c

    SHA1

    49d8ef6835a6de734ead4e0b2cbbc65735cd5c17

    SHA256

    cc7a340bffc39d8d8f704314f0383404590438b8cd16e780e0a26723bceedd21

    SHA512

    b9902e0112bbf053ec4e3aa633ac2f2dd938b23507ff58ed69ac580656e42874c4b0ccb0d393b26637ae2b98feee78023d62378adb99140736e314de74fb399b

  • C:\Users\Admin\AppData\Local\Temp\{85A3412E-3CE0-48BB-AA50-74C25E4063D8}\_Setup.dll

    Filesize

    167KB

    MD5

    262cc5a5e5a007ae182c45e41ac35adf

    SHA1

    999582209e73d92d0040b8092666087aac2cee90

    SHA256

    ecc186e0284593db51463f104ba8486b1de656d47a290d27c6fea157cb1495bd

    SHA512

    2f59e23646774c3e5034d464242ac128cfb3ced1a0498dd0f719308b5854fbba20d457127e01b414f12b63d8bc3baf7ffcf89d91300ca43b90ed6cc933e4bd5b