Overview

overview

10

Static

static

10

e33ebc39eb...f3.exe

windows7-x64

4

e33ebc39eb...f3.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/01/2024, 01:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3.exe
  • Size 25.9MB
  • Sample240105-be925sfaar
  • SHA256 e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3
  • MD5 SHA1 SHA512 SSDEEP
Score
5/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 4 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 32 IoCs
  • NTFS ADS 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3.exe
    "C:\Users\Admin\AppData\Local\Temp\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Registers COM server for autorun
    • Modifies registry class
    • NTFS ADS
    PID:440

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        HiveCloudBridge.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\HiveCloudBridge.dll
        • Size 209KB
        • SHA256 fe40316b9e69c9c26c19010e45f6dd20c637a65faea3c81875757aab92c5486c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        HiveCloudBridge.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\HiveCloudBridge.dll
        • Size 223KB
        • SHA256 c868bf456a7310ae40a45a2200109af692d63e201a1ecf8f24d7b3ed920d7478
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Microsoft.Win32.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\Microsoft.Win32.Primitives.dll
        • Size 8KB
        • SHA256 b7667eae29090714cab539afb8433ee12e6773563ac773b67cbecaf2bb41c9a8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Microsoft.Win32.Registry.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\Microsoft.Win32.Registry.dll
        • Size 24KB
        • SHA256 fc6159cf5e9475f1523f042f19a565f5a6c21be59a04f14b3823b23d62e568b9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Collections.Concurrent.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Collections.Concurrent.dll
        • Size 48KB
        • SHA256 f4bf911df2f0e9c8e0679635a3ddbf48e0ec962ba8b06180258b738b77575e51
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Collections.dll
        • Size 27KB
        • SHA256 39ef2bd6e74523991dd242994f0316fdba1c36c4f1777fd6fab30183b1046576
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.ComponentModel.Primitives.dll
        • Size 19KB
        • SHA256 d75b9620fc98e635ed1ad82d8ba309fdf8442cf3ce9cb807be314afbf610d079
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.ComponentModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.ComponentModel.dll
        • Size 5KB
        • SHA256 257c7d0abf221767e29d0fb622c2848682b835afeae35ce9640c93d9f309a2d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.FileSystem.AccessControl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.IO.FileSystem.AccessControl.dll
        • Size 16KB
        • SHA256 5cc66c6a2347d09939d777061b9bcc3a9a2bb55d93f8a03799b728b718cfd4c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.FileSystem.DriveInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.IO.FileSystem.DriveInfo.dll
        • Size 16KB
        • SHA256 ced4e9a148cc3a2704bb3a6d1e393fa31864aa0da9e3e6752102d46a4fd9dc1a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.FileSystem.Watcher.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.IO.FileSystem.Watcher.dll
        • Size 26KB
        • SHA256 c578ccd9a56d29eb914b6ede2127092e5978edb59e3525f6ef17b2dea85fc238
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.Pipes.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.IO.Pipes.dll
        • Size 42KB
        • SHA256 7e129aa7e87d73e82451a23b2fd03a67d63ab20a08cab4e8a4daa0b404ed4bf4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Linq.Expressions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Linq.Expressions.dll
        • Size 120KB
        • SHA256 543539997eef40dcc7f27f6e33ffc619acee5a488d53f3b36aab71ecbfddf78a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Linq.Expressions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Linq.Expressions.dll
        • Size 21KB
        • SHA256 b9fc243ecc281d1422bbc99e369942f3cf2473ea7f276d24380f2eb50b1efd73
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Linq.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Linq.dll
        • Size 72KB
        • SHA256 8752df977be8766c4ae4f57196e056d4387ccfd35c5c10652ab262802ee3af7f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Http.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Net.Http.dll
        • Size 108KB
        • SHA256 f7e38693c54aaf84172ff68a0170a3ceb38fc2c2a734cccd317fab3dd1c49d75
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Http.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Net.Http.dll
        • Size 67KB
        • SHA256 cbc71e8e6d99602bdcddef5f695a5a4a9e6d4c134868e3484f4c87303450e1f9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Mail.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Net.Mail.dll
        • Size 121KB
        • SHA256 fdbbc19aec96debc6e7d9a5469bf9d8780c31528725b79776a058cca8c64d688
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Mail.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Net.Mail.dll
        • Size 107KB
        • SHA256 b8c7ac4e32f5525d894ea0873124f3b42ad0eafbe672691eae9307824fa4b7dc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.NameResolution.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Net.NameResolution.dll
        • Size 31KB
        • SHA256 9ea609edc3ab4d94b27372fd640b248be3f20f651efe2aa725eda36bb25c8b91
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.NetworkInformation.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Net.NetworkInformation.dll
        • Size 33KB
        • SHA256 ba389134fadf58df36efc54ddd0da01d3fdcba5a8e94df5be539b853a144a9c0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Net.Primitives.dll
        • Size 67KB
        • SHA256 71a62e2ea3abf557ec5708623ad81fac83e51b49ddfa06e136c27a3364ae1534
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Quic.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Net.Quic.dll
        • Size 57KB
        • SHA256 c2e88789b5b3287159db1295d869d6ecdd8fb36a1312cd7775b88ef512683447
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Quic.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Net.Quic.dll
        • Size 65KB
        • SHA256 34ee7744fa6311ddafbe42080afb1fe4744751ceb30d2f1a3949ce11c90c66ed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Security.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Net.Security.dll
        • Size 125KB
        • SHA256 4086d5a102d7968dc50aaba9eb551249b3118dd49b03e02db663e7a9cc64444a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Security.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Net.Security.dll
        • Size 61KB
        • SHA256 a8f5ed972bd488a460a1f57691352b6ba81f8ec4ff8aa921780f0954c42fc3ab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.ObjectModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.ObjectModel.dll
        • Size 29KB
        • SHA256 372ca80aa606cf3f77dbd7c2446f34f1e7296f23ed19d3ff1c5f760dcb0a9d1b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Private.CoreLib.dll
        • Size 414KB
        • SHA256 c68acae808b188bf7c2b8420f492cb0da866e7d6fb9ff00af96ed09b74ab9250
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Private.CoreLib.dll
        • Size 449KB
        • SHA256 97a1cef297eaa2d726c905c71fe5955365645c9bf5225b6d81e1c3b8dec6c2e6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Private.Uri.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Private.Uri.dll
        • Size 75KB
        • SHA256 17efa5a20ca97f7994701193efd7758aa827c147e94c96ed2cadba4fd1a24553
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Runtime.CompilerServices.Unsafe.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Runtime.CompilerServices.Unsafe.dll
        • Size 5KB
        • SHA256 f894ec740edade3bd17e90a3fbcdf918c1ef9c41234b42494ecea5ea4d84c048
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Runtime.InteropServices.RuntimeInformation.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Runtime.InteropServices.RuntimeInformation.dll
        • Size 10KB
        • SHA256 269b9f5239434cb56349bf141cb45753bb3ec7ee3c875db9b74f928247b4bcfc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Runtime.InteropServices.dll
        • Size 7KB
        • SHA256 be4816d230e686cf961c22d62e00eb375047908201fda7e73411b00b7679ab08
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Claims.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Security.Claims.dll
        • Size 15KB
        • SHA256 73fe08c2a568fef8962d1ba2faeb7165ac8182922b27dc9e9667bb468eb5877e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.Algorithms.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Security.Cryptography.Algorithms.dll
        • Size 98KB
        • SHA256 0307a4241e4bbdea814e0b689d8e598b8ad544f98ea705a7da2549174d8d2bc8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.Algorithms.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Security.Cryptography.Algorithms.dll
        • Size 74KB
        • SHA256 c5ad97176e84438f339de65510d953b72fe4fe8ed2501d7c13b17de23adfe57c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Security.Cryptography.Primitives.dll
        • Size 36KB
        • SHA256 9b969f88010c5556456b27ff86f306c05d51e4e20c7d1225c2d114cc15e40398
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.X509Certificates.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Security.Cryptography.X509Certificates.dll
        • Size 57KB
        • SHA256 2e7b4e18a700b943793d47a7a230c4b2f2f690c5efb264acd44e5671d640176d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.X509Certificates.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Security.Cryptography.X509Certificates.dll
        • Size 98KB
        • SHA256 82e63d2074e5e6cffeb29559882ec7abd1bd5d72385e2363b9d50cf809869840
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Principal.Windows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Security.Principal.Windows.dll
        • Size 50KB
        • SHA256 fe9c9cac9ec6688843de8d91af66f6a2e63ee6f0863b26b2916e26c4b2e7a643
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\e33ebc39eb187c1d264486df317a5e702cddaa9d4a7f70a146c711b366e2baf3\RuKbLqRFwfsbnyKYSjcw_tIfMmFgj6k=\System.Threading.dll
        • Size 17KB
        • SHA256 f922614d39c635d1d18eccc03c82ddb4b10a9988a3eb7c359191dae304e0ea0b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/440-155-0x00007FF7372B0000-0x00007FF737C21000-memory.dmp
        Download

        memory/440-341-0x00007FF7372B0000-0x00007FF737C21000-memory.dmp
        Download