Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 07:48
General
-
Target
12924c1485ff271c0ab55788b6b6666f.exe
-
Size
392KB
-
MD5
12924c1485ff271c0ab55788b6b6666f
-
SHA1
90ca51af2a02b359fb5869057a5dab34645a4691
-
SHA256
4c8ee30b6515c2de643d67c4af908067c40e6810daa5c8585938208101dcfbf1
-
SHA512
5887632ca8440bf19a9c01e42512b0fb47870c226fe3edf81475e4d39cd09fc46ba0c53465610d5d069a671e5d56364d011d9780900ef41ffde0f261f2f61913
-
SSDEEP
6144:e3Bn84cWxCfsbMam4XspTJ755+SQ0FdiXzen/Q/uib0lkb9fcI+dtJ:elaEgnRJDe0+XzmpU0s9fcIc
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\12924c1485ff271c0ab55788b6b6666f.exe"C:\Users\Admin\AppData\Local\Temp\12924c1485ff271c0ab55788b6b6666f.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\applocker\ilib.exe"C:\windows\system32\applocker\ilib.exe" /i2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD51c57d9c16c5b0644bb3c60383c97ded5
SHA1edbb53c49e7f4325dce4154cfb298638bc4a2cd4
SHA256ba879a0870651494b158be922ac19c552431c3857ba15fe437f6993d46f8810e
SHA51241bc6f6a6b11ebd16f9c364f475f0b608b1837710de37c2efd34cb1b8294a5b0732b16323548676002ccc32e12c8b3613cc35be3c3438a23b677e948e13102ee
-
Filesize
19KB
MD5eb1fd7082364fee0195af94b30241bd2
SHA1d7cdfdd8f4b860a306a6b659ee67ec25bdf901c4
SHA256ec8f29a739d8f036d9490931a81a9e09dc830683dff6788b7f86ff299e449877
SHA51226a2710070a8a91848e9ee7a4d4faa68b2f6107b22330eb76fe714ca8453371cc03c7f748802a9cac31b46a34ddddf37c8f806cc3d10e604694be0c0e0586df6
-
Filesize
92KB
MD5836fb69dd33f8da89dc8f8232ebf0cca
SHA16cce0f2cb28ec77ef31ae2df7b64e35e963cd9be
SHA256e08cfb3c74eccf1ebf6069444939cbd6e7653de4890776e93a6c538827adf781
SHA512b54f496b32188e5bad4543327006084932bc1484d1fb322afeb4b977513cec79289a0f4e4232448967e69100e6c3551598fee6a4101ae169cf689a333ebe4d85
-
Filesize
61KB
MD59e62b721a296ab831aea89e1de8bd879
SHA12d94dac8622e25e88d2e35f0f2b6dd39a0b600da
SHA2560006955f13d539abe7bdb409401d52ed887fe35abe3497fa352893a3604f694c
SHA51271c538e06e256fd7fd78f565cfa5129be44f4dd26e02155d0b010c451e7baa6d34ebc6e47acac35eaea82052668ad11c5f579a2ca0a086cef27f1a2db9f4537a
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB