Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    30-12-2023 16:54

General

  • Target

    0330e56d9934c003d980696886140aee.exe

  • Size

    136KB

  • MD5

    0330e56d9934c003d980696886140aee

  • SHA1

    186597eef866aea398aea03115bb6dc618c5ba70

  • SHA256

    7376ffc4a3697f8739762e401e785d0235ec04d953ec2ca0418e7fce4f48464d

  • SHA512

    bc0af45e86bac36bace32ed125db5598dee21d59d786a48b93e30052f8aabb5a8595861e1cb31a780d37c5e11aff209fc43d909c947670b692a54e17658459e1

  • SSDEEP

    3072:BmonwjBfQn7WbIqH0ybZBiOllyEmcP82+aVdOt66VGegmv:BmFQn7WbIqH0ybZBiOllyE5D+aVkjseN

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0330e56d9934c003d980696886140aee.exe
    "C:\Users\Admin\AppData\Local\Temp\0330e56d9934c003d980696886140aee.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Users\Admin\rieec.exe
      "C:\Users\Admin\rieec.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\rieec.exe

    Filesize

    136KB

    MD5

    8195b31e20de28cc1b03a0b55debee6c

    SHA1

    94ffbe8ec8a55136ea51dde54397de7325c75c0c

    SHA256

    b5026286e0deed10c1a867b1104158bc0a7fb5573c2193a0482ce10864391bce

    SHA512

    83798e8cfb80875086d88527eec3e3fb03b288dbfa9b4a51a99adbe60e4f2ebad65eb0d9b45781ed762384a999bf4379e7ea46a85113bcc98f06f36dd2a55278