Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-01-2024 11:19
Static task
static1
Behavioral task
behavioral1
Sample
5650b454063ee115c22f9eb94587e24e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5650b454063ee115c22f9eb94587e24e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/downloadmr.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/downloadmr.exe
Resource
win10v2004-20231215-en
General
-
Target
5650b454063ee115c22f9eb94587e24e.exe
-
Size
142KB
-
MD5
5650b454063ee115c22f9eb94587e24e
-
SHA1
a352fdd47794ce93c2c04c4ee52e6468c3e9e745
-
SHA256
46151c3bdd0a1cb9d1f97ee02cec6e555a92289c62b6ad69c51fafca4c61f8bc
-
SHA512
8a2ea7ea029f811b82b8d3851d73e98689bea5cbc7c664bc89b9f81b99bee7f581039dba5bd70bd528e5512dbf361aab78c97bf9e8916dff9e79ccaf4fff8d19
-
SSDEEP
3072:KnOn7t7XpdpCCTg/sxFgJaeqgKJ+BCCCU3QHUecyi9jZsf6nn:KKpdcCrTdgKPUGyZu6n
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3136 downloadmr.exe -
Loads dropped DLL 2 IoCs
pid Process 4064 5650b454063ee115c22f9eb94587e24e.exe 4064 5650b454063ee115c22f9eb94587e24e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3136 downloadmr.exe 3136 downloadmr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4064 wrote to memory of 3136 4064 5650b454063ee115c22f9eb94587e24e.exe 44 PID 4064 wrote to memory of 3136 4064 5650b454063ee115c22f9eb94587e24e.exe 44 PID 4064 wrote to memory of 3136 4064 5650b454063ee115c22f9eb94587e24e.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\5650b454063ee115c22f9eb94587e24e.exe"C:\Users\Admin\AppData\Local\Temp\5650b454063ee115c22f9eb94587e24e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\nsl6F27.tmp\downloadmr.exeC:\Users\Admin\AppData\Local\Temp\nsl6F27.tmp\downloadmr.exe /u4dc9054e-38b0-4614-bdd5-20605bc06f26 /e494772⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD55ebc73650256e9c8ddbcda231db829a1
SHA1988d4535e18754ab2a6248abae96c5697d7dbcd5
SHA2561eaa543842df7795404184e8892a1654b0773dbc9bd8b54c7fdb9e68f4355493
SHA512b21266e76fc7263af982a1336a766e47ccf348ed56b305dbb09f03574c9b2a7309f12200e80d86f9a251381be6e87a41206447f11c51899cb31fba10da1d5270
-
Filesize
122KB
MD5da254a8488b60244654e1cf4d6796cf8
SHA123d06f4589786652a3a226b5012a5520a3d03452
SHA2566d3b82a7ad74a1e88ae4d0f9176082130f1558fb3ff42a8b45ca8b80445efc2d
SHA512d311f90ad65441f6c7ae55220c2c3f117aa7601d083e6847e1b58b96c3c332d68a25d445310818396dc88678fb9ec5356f35a04a392c3d23746a2231e14b0a2e