4b4a61da0d7985cdea867f2e6d9a79b3c6b6cbfc38949a84fbdf7814326764c4

General

Target

40afae529227a63296ddf9d4bbcd43c7.exe
Size

4.3MB
MD5

40afae529227a63296ddf9d4bbcd43c7
SHA1

23d6c1a8daca032c15f33a2359e46ebd68ed5ff7
SHA256

4b4a61da0d7985cdea867f2e6d9a79b3c6b6cbfc38949a84fbdf7814326764c4
SHA512

b6346023b4f4bc94da8f607c52e8009009c6ad4a683b5b5cea6cae19e7cf2be086dc748a886b175832749a7eb5dd9d529fc452323a7230004c4fad0010e07b4f
SSDEEP

98304:MytIEQaoqS5APK7r9Jwv45iv96v1eyZ4FpO+R0N:MytIE6q2Ay7r9JwoA6v3GpOTN

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3032	40afae529227a63296ddf9d4bbcd43c7.exe
3032	40afae529227a63296ddf9d4bbcd43c7.exe
3032	40afae529227a63296ddf9d4bbcd43c7.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BouReyhan\shell\open	40afae529227a63296ddf9d4bbcd43c7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BouReyhan\shell\open\command	40afae529227a63296ddf9d4bbcd43c7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BouReyhan\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\40afae529227a63296ddf9d4bbcd43c7.exe \"%1\""	40afae529227a63296ddf9d4bbcd43c7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BouReyhan\DefaultIcon	40afae529227a63296ddf9d4bbcd43c7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BouReyhan\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\BouReyhan\\Icon\\Document.ico"	40afae529227a63296ddf9d4bbcd43c7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BouReyhan	40afae529227a63296ddf9d4bbcd43c7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BouReyhan\ = "BouReyhan Document"	40afae529227a63296ddf9d4bbcd43c7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BouReyhan\shell	40afae529227a63296ddf9d4bbcd43c7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.brn	40afae529227a63296ddf9d4bbcd43c7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.brn\ = "BouReyhan"	40afae529227a63296ddf9d4bbcd43c7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.brn\Content Type = "application/brn"	40afae529227a63296ddf9d4bbcd43c7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3032	40afae529227a63296ddf9d4bbcd43c7.exe
3032	40afae529227a63296ddf9d4bbcd43c7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	40afae529227a63296ddf9d4bbcd43c7.exe

C:\Users\Admin\AppData\Local\Temp\40afae529227a63296ddf9d4bbcd43c7.exe
"C:\Users\Admin\AppData\Local\Temp\40afae529227a63296ddf9d4bbcd43c7.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\BouReyhan\Dll\System.Data.SQLite.dll

Filesize
883KB

MD5
80725a732aba27911402f9ca09fede23

SHA1
1051744f654a6d20590970f9335e1ef246f0fa67

SHA256
49261be7f20c9d9dfd1ff35d71e9f3b1b7de17f65581c67beed43d933f1eb85c

SHA512
b24c5e5e55751b46af7fefec92552e04ddb6051e81174c1cae2d80ed1eb8b2c355c7a1eea93074abaeadfddf30e17a7425f14716cd4f2dfc50048b7fbfba6b49

Download Submit
memory/3032-88-0x00000000082A0000-0x00000000083A0000-memory.dmp

Filesize
1024KB

Download
memory/3032-77-0x00000000082A0000-0x00000000083A0000-memory.dmp

Filesize
1024KB

Download
memory/3032-3-0x0000000000BF0000-0x0000000000C30000-memory.dmp

Filesize
256KB

Download
memory/3032-4-0x0000000000BF0000-0x0000000000C30000-memory.dmp

Filesize
256KB

Download
memory/3032-5-0x0000000000BF0000-0x0000000000C30000-memory.dmp

Filesize
256KB

Download
memory/3032-2-0x0000000000BF0000-0x0000000000C30000-memory.dmp

Filesize
256KB

Download
memory/3032-0-0x00000000748E0000-0x0000000074E8B000-memory.dmp

Filesize
5.7MB

Download
memory/3032-83-0x00000000082A0000-0x00000000083A0000-memory.dmp

Filesize
1024KB

Download
memory/3032-84-0x00000000082A0000-0x00000000083A0000-memory.dmp

Filesize
1024KB

Download
memory/3032-86-0x00000000082A0000-0x00000000083A0000-memory.dmp

Filesize
1024KB

Download
memory/3032-1-0x00000000748E0000-0x0000000074E8B000-memory.dmp

Filesize
5.7MB

Download
memory/3032-87-0x00000000748E0000-0x0000000074E8B000-memory.dmp

Filesize
5.7MB

Download
memory/3032-93-0x00000000082A0000-0x00000000083A0000-memory.dmp

Filesize
1024KB

Download
memory/3032-90-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/3032-91-0x00000000082A0000-0x00000000083A0000-memory.dmp

Filesize
1024KB

Download
memory/3032-92-0x0000000000BF0000-0x0000000000C30000-memory.dmp

Filesize
256KB

Download
memory/3032-89-0x00000000748E0000-0x0000000074E8B000-memory.dmp

Filesize
5.7MB

Download
memory/3032-94-0x0000000000BF0000-0x0000000000C30000-memory.dmp

Filesize
256KB

Download
memory/3032-95-0x00000000082A0000-0x00000000083A0000-memory.dmp

Filesize
1024KB

Download
memory/3032-96-0x00000000082A0000-0x00000000083A0000-memory.dmp

Filesize
1024KB

Download
memory/3032-97-0x00000000082A0000-0x00000000083A0000-memory.dmp

Filesize
1024KB

Download
memory/3032-98-0x00000000082A0000-0x00000000083A0000-memory.dmp

Filesize
1024KB

Download
memory/3032-99-0x00000000082A0000-0x00000000083A0000-memory.dmp

Filesize
1024KB

Download
memory/3032-100-0x00000000082A0000-0x00000000083A0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads