Analysis

  • max time kernel
    42s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2024, 08:33

General

  • Target

    58778d3ebe0ca1ce1ad46e92bddb7178.exe

  • Size

    252KB

  • MD5

    58778d3ebe0ca1ce1ad46e92bddb7178

  • SHA1

    9e48da115edf0a4a0c0fdf39c417f29d91d63f4c

  • SHA256

    0509a733af4977382669821b83eefa38c8d6558c0d370d233b506dda487a8de2

  • SHA512

    f802220e8d37e2da353543b491b5d0d35248748a5c8a534e062ef8069f82f10af53e97b8a3b32c508754f26244ffb67406db9cbb40e5dc86d4a5a1660bb924bf

  • SSDEEP

    6144:wTlFiVGBngFg4S628gA/igGuncMkcH/AeKnvmb7/D26ppSgCbvfXG:cHigBnga4S628dFncMkcHIeKnvmb7/Dp

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58778d3ebe0ca1ce1ad46e92bddb7178.exe
    "C:\Users\Admin\AppData\Local\Temp\58778d3ebe0ca1ce1ad46e92bddb7178.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Users\Admin\daonae.exe
      "C:\Users\Admin\daonae.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\daonae.exe

    Filesize

    92KB

    MD5

    10e9a79c994c99e13950d7973c65af15

    SHA1

    1f8a77a14473dbd0563fd3e9a1f6f37ba4903e39

    SHA256

    0ec9df551efbe9e2b3713d77cdf0f18da6cd43e449ceb1d19618ca5606c584d8

    SHA512

    861908b3270ea0e5a29570e163f09ef2590150b377e88d2320e0e69fff5e2ddef30b75289d4bee79c5f2049a96739988baac0a4064173137ab8ad58ec78fdbaa