Analysis

  • max time kernel
    158s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 18:55

General

  • Target

    3acb995c9f962f1004397bcbd3fa55dc.exe

  • Size

    260KB

  • MD5

    3acb995c9f962f1004397bcbd3fa55dc

  • SHA1

    8239187c47d046fbd4b76896e78b304624cf2b0c

  • SHA256

    30d5e95f20ff0a384bcbe980cff2cac965301555c50bffb18e37f770957f950c

  • SHA512

    cb32938148716617e8c2b658200799434766d42c68b3aaa35e209f6a47e67bff8fd96661488091b56bdf281e8439fa79e591176dbecb0e0617e5fc4b8c394b2d

  • SSDEEP

    3072:JgfAlNgvh25n/kZoSUjMqXnpWAkpAmTSrMaIOYt/jo7LAtPhjjtZnfHFEoWBfGVK:JdFgTSrMaIl/jcLijfHFEHWzXvjT85R

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 51 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3acb995c9f962f1004397bcbd3fa55dc.exe
    "C:\Users\Admin\AppData\Local\Temp\3acb995c9f962f1004397bcbd3fa55dc.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4128
    • C:\Users\Admin\qagul.exe
      "C:\Users\Admin\qagul.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\qagul.exe

    Filesize

    260KB

    MD5

    3f6a057d3231d1918b0319546ffed3ac

    SHA1

    61f0905501c3f555878ef69ea4cb711b37d530a1

    SHA256

    c4014f2319636d1706563c9960b7e5c91908e93b179630d60d0d22526e92b2e0

    SHA512

    ac3c3bc61c43d6ec5c83a20db4ff38974c26d564a1d5bf177c3766f3f073403e775ae2446ad4e90ca03f60653017a335a708784683332fd938925a505e500694