Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
31/12/2023, 06:58
General
-
Target
2c7c53cc215cbc87b9d0fdd03a4a13ce.exe
-
Size
4.8MB
-
MD5
2c7c53cc215cbc87b9d0fdd03a4a13ce
-
SHA1
ed49a3baf836e3c0c27cb1d575b48a2676e42b4f
-
SHA256
982de5fb844c74f708b0bcfff37b573614176cd311feebaa429ca0e5bb3550c5
-
SHA512
1ed85a115a200e31c3f286e4089a785c33d6265798eaf615188e8b89c8b45454c8579cc71a447552780b3bb2f3f3b4bb36a1567f9b0414520d73b4319e44516f
-
SSDEEP
98304:PX4kkWgiZ+zf/jghmMGqfvmP1/rO8ix0OhgJIXi49koyazx14:vZkWBZ+/gcqHW1/LPO6JIXi49koya0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 23 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c7c53cc215cbc87b9d0fdd03a4a13ce.exe"C:\Users\Admin\AppData\Local\Temp\2c7c53cc215cbc87b9d0fdd03a4a13ce.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8Q6PC.tmp\2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp"C:\Users\Admin\AppData\Local\Temp\is-8Q6PC.tmp\2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp" /SL5="$5014C,4341601,721408,C:\Users\Admin\AppData\Local\Temp\2c7c53cc215cbc87b9d0fdd03a4a13ce.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Quas\Magni.exe"C:\Program Files (x86)\Quas/\Magni.exe" 4dfbcb6392e4e82dec956a1f358df8ce3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD55fe40677b50096692706255b5c62727e
SHA1e4b97631628b7551ba4f495de3e004c675779479
SHA256cc14ece6975fdb016b2cc5766ab8365a6e81564e4021c17f564ca797926fd407
SHA5128b31fd227170d7f907122dc43750ac003bd0eba46dadd24935a3b9940661857a4a4d26af0d1cfe1e026aaa965e204202e363309def3e66509dae29596f6f9e30
-
Filesize
382KB
MD587a3b02d203d1c69ef3b4f9a50f848ce
SHA1a621ca18c711e03f4c8f1deb06d7aa07c1b3d1c0
SHA2561aad33314da6b332f3c71df86d61216bf5cb4331c53b4894ef6d48059bf4effe
SHA5126c777ad8be8fb29d7a0813442b0b7b6d99fc9f1c14a592535f4208d0b0d49866d54801bdc47a81190875c142b4e35252453a141c30ccd0bf8bd72b764350f5ab
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
18.7MB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
18.7MB
-
Filesize
18.7MB
-
Filesize
18.7MB
-
Filesize
18.7MB
-
Filesize
18.7MB