Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29-12-2023 20:11
General
-
Target
02aa4aac6bc417b73d6ea452194252fe.exe
-
Size
786KB
-
MD5
02aa4aac6bc417b73d6ea452194252fe
-
SHA1
69d4e8942d6c3891a06b988ada2cb8a75fc738b5
-
SHA256
d8c56946b65ffcf4b6aa2bd510fefb626edcc2a135c07e2f0175686aa0e588e6
-
SHA512
c241466c03983fa0809836d61db44c640c2ae16d8349723327b6bf0cc5267c69ecf4c91c74ba7e948655ff3b4bf9dd72046e11d4d9a123f35f1dde40e63c4158
-
SSDEEP
12288:vyxPJa2s86jofrWEuxjcZxyPq8tf8sQ+PRtj3lDsmMHj3N6eiaFmhL+JigD:vyxPJ/s86szWEuKiflOmMDhPEhL+lD
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02aa4aac6bc417b73d6ea452194252fe.exe"C:\Users\Admin\AppData\Local\Temp\02aa4aac6bc417b73d6ea452194252fe.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2868-3-0x00000000000A0000-0x000000000016A000-memory.dmpFilesize
808KB
-
memory/2868-4-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2868-2-0x0000000003310000-0x0000000003356000-memory.dmpFilesize
280KB
-
memory/2868-7-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2868-9-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2868-6-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2868-5-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2868-15-0x00000000000A0000-0x000000000016A000-memory.dmpFilesize
808KB
-
memory/2868-18-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2868-17-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2868-29-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB