Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:21

General

  • Target

    49816a8397e134d8fc34c2c8d004912a.exe

  • Size

    144KB

  • MD5

    49816a8397e134d8fc34c2c8d004912a

  • SHA1

    625545a06c6c35d0258534c1c4cb4efeb14a44ba

  • SHA256

    2047a6293bf48347746b1eb89bba86a722f6888fba1a55cccc9c6fa6c59efb2c

  • SHA512

    5924273c427a121269fd05e57a4c202fd6951afa878c1145c445a43edff24b379df75d6d4f5c86d88803861e2ac75c9b4d9ebd80ba19b7c41229cc6f31d5f272

  • SSDEEP

    3072:RD01BKcEUqZhplZRC7/veXx8pUPkDRcrLNfisA/N:RYLlEUqzPZ8eXx8pUsDRcHNfisAV

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49816a8397e134d8fc34c2c8d004912a.exe
    "C:\Users\Admin\AppData\Local\Temp\49816a8397e134d8fc34c2c8d004912a.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Users\Admin\rplas.exe
      "C:\Users\Admin\rplas.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1080

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\rplas.exe

          Filesize

          144KB

          MD5

          a6cfaacb191c4874b27071abebde723f

          SHA1

          683475f35398df3dbf1aa4b5a9648c4180dd10f2

          SHA256

          028937327aa0a61e34c3ca0ef456227222b57c6505bd1515ca81a85cd34ccae8

          SHA512

          04d685d3c8148c6c68412fc91057f22155a0d2101784831af8fa8bbdf319101e46bd80c844448316fc07a6b35cf4252ad30d686a15e6cda2580443cc7c94a742