e2fae47a626faef8538b9ef12935a02cfd26193bc283d0306e310a1403710223

Analysis

max time kernel
171s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

teknohelper.exe
Size

457KB
MD5

a5dbf2b7cedc1bc16324b906d6c4e79c
SHA1

d78da1c2d3fc9e3a6039537e0901986637b21822
SHA256

43fc888c86ca530aadddf0b7a3874981fdbf6ffdfeb17566e669964b8fc158bb
SHA512

58a205edfd79458686035063c50afc301771fdbba1150201c64a4fae279a648c05b9055b1279587ab2715b39a4d1446f7c419402634e254a4ac4da679695a518
SSDEEP

6144:WpvhSvqHoHPjfx5ONI/nwugiLGCnNYkgRzw/4nVZeg9ZJm1N+SdfmK/SAy0:svhSyILJ5bnwuLL9nN8wy59ZI1wpay0

Score

5^/10

Malware Config

Signatures

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral8/memory/4856-37-0x0000000000400000-0x00000000004B2000-memory.dmp	autoit_exe
behavioral8/memory/4856-42-0x0000000000400000-0x00000000004B2000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4856	teknohelper.exe

C:\Users\Admin\AppData\Local\Temp\teknohelper.exe
"C:\Users\Admin\AppData\Local\Temp\teknohelper.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autE416.tmp

Filesize
28KB

MD5
0e9addb0fb4415daaf68cfb63377bde9

SHA1
d25e042177906c8c9800f206bea3e3af8be7701d

SHA256
fa64a812e738a1d69946fac117cd94cd34a0ae57d396fccbc849f3a87ace184d

SHA512
875a3f42ad4e6845506f5ffafef8848ea369ec07af1b4da7329269a6a488097e26f380a4fb2f75da67adbbcca5a1019ed7195f04e6980138f1761fd62cc0c4a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\disable.gif

Filesize
95B

MD5
17ed44fbb41d2582e5fdce0cf8f6f5c8

SHA1
ef2e3d9a288279bf8f9aa8a90632c36e03cf0dd4

SHA256
94d67732be172a0f16383fe05b711419adaf847873f0a8786262d42a4eb65b32

SHA512
865e5f71b517c79f196b4b90d6208120ae62c092a14eb4e4bbb508db4c9f73b191ed29e967658c26ac81902890188f2ea921a7baa43fac89e46cf5b893287ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\next.gif

Filesize
240B

MD5
f5b5ea3addaf6c9aaee9182060a35376

SHA1
a6bd2c960d589bf90bf1220c866b8ef279d777d6

SHA256
bfc66200f87f31f0647b31144fe5f7f3f93a271d9644f95427eb38963f36f63f

SHA512
3a6dfccad04771f03f45036be62e503b7b57ee0d205de6df10d8d83285d87495ac4cbd70f4848684bb2255a18afe4591d59774f413bfb9ef7bef882e47c0d5fc

Download Submit
memory/4856-0-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4856-1-0x0000000001970000-0x0000000001973000-memory.dmp

Filesize
12KB

Download
memory/4856-37-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4856-42-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4856-43-0x0000000001970000-0x0000000001973000-memory.dmp

Filesize
12KB

Download