Analysis
-
max time kernel
10s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
31-12-2023 03:15
General
-
Target
260441ed9d2a0fb7db58c1b904c7c374.exe
-
Size
241KB
-
MD5
260441ed9d2a0fb7db58c1b904c7c374
-
SHA1
b0c88807180389872df34dd98b1e3bdbc1a6f6e9
-
SHA256
d67091e8079d0dcf4f3962628e4f7520309a8111750082218c3be89a8fa70e3d
-
SHA512
3aa5326cd6a49f117e2097c457fdf85c0fcf88e39fd0966893504da9cb13cd16275a444336e49462edc2e375cbf888d543184fdb2be00ce71716f2f695fd6005
-
SSDEEP
6144:PXyH5a0vECLJg6bEmNAgGA1C4PGtv13T:6H5zY6bRKgGA1CkY9
Malware Config
Signatures
-
Detects Zeppelin payload 6 IoCs
-
Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
C:\Users\Admin\AppData\Local\Temp\260441ed9d2a0fb7db58c1b904c7c374.exe"C:\Users\Admin\AppData\Local\Temp\260441ed9d2a0fb7db58c1b904c7c374.exe"1⤵
-
C:\Windows\SysWOW64\notepad.exenotepad.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" -start2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
241KB
MD5260441ed9d2a0fb7db58c1b904c7c374
SHA1b0c88807180389872df34dd98b1e3bdbc1a6f6e9
SHA256d67091e8079d0dcf4f3962628e4f7520309a8111750082218c3be89a8fa70e3d
SHA5123aa5326cd6a49f117e2097c457fdf85c0fcf88e39fd0966893504da9cb13cd16275a444336e49462edc2e375cbf888d543184fdb2be00ce71716f2f695fd6005
-
Filesize
92KB
MD5b00bdd86eac8de702ff32fec978b8318
SHA1a4c4414a5a9967b9509a3d0c40adf924458116a6
SHA25676ae6d919e467b8542ec99a077202fd23a474e4e9432b435f67cc3a50c6225ab
SHA5123520de6fdbeea77b3d41f01416d9411d1530acfb4218f4ff5e7cf541f6cab8232906edc96c22b9dea40e334a8e2da8ae05796084103a9260c6de2805c17721ef
-
Filesize
1024KB
-
Filesize
40.8MB
-
Filesize
1024KB
-
Filesize
40.8MB
-
Filesize
40.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40.8MB
-
Filesize
220KB
-
Filesize
1024KB
-
Filesize
40.8MB
-
Filesize
1024KB
-
Filesize
1024KB