Analysis
-
max time kernel
134s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
18/01/2024, 10:05
General
-
Target
651d91d3ebde3977b10ebadfe0269d4d.exe
-
Size
9.2MB
-
MD5
651d91d3ebde3977b10ebadfe0269d4d
-
SHA1
2b8cf23d30ad284da26bad86ffaa9ed2b246b512
-
SHA256
36ea9c07252aa739c8a8366453f629a5762afc152b32fa358c893ca0233791a6
-
SHA512
3930c42654d9a9e84b8aa6a500b425beb98df2282415f2654556bdee36ec8821bd7df428d9522c8a695ca9dc2f9a8fd6dd579e05c8f5c21d583b0c4c4276adf6
-
SSDEEP
196608:R01dh08Tgk7c/ihukxA3f97Y1zO2sPnGMfhReCWJo8i1zwh/:R2dDTfc/YXq3fxY1ranGMbso/NwV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\651d91d3ebde3977b10ebadfe0269d4d.exe"C:\Users\Admin\AppData\Local\Temp\651d91d3ebde3977b10ebadfe0269d4d.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\k344cwau.vc5\651d91d3ebde3977b10ebadfe0269d4d.exe"C:\Users\Admin\AppData\Local\Temp\k344cwau.vc5\651d91d3ebde3977b10ebadfe0269d4d.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 17083⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD5d4b49ac61a6cac139f96450777c10204
SHA192089d33442c9e2eaceac3ed8db6a7168f938e5a
SHA256807bdfa62a4312030c1ed54981674cff77f6108e6b4957754cabb810098ce082
SHA512eb13a0e7f0d4b44db7e8d0625ba1ee6a036083c39c24b85493d3ec9074ada03eb7003b97bd92ed5f2baaf26295a4690303332593c4776e75da5bc3b6adbc3ea6
-
Filesize
48KB
MD579e302e289777f106d299b6138115651
SHA11cd985cab550b6be5835bccb422c520568ef36df
SHA25646320e5c12a81ec504f53c85daec5bc7ddd45c1624b38742c2ceb13e09da5e03
SHA5122b90a14ed3340fb3ac7b098e1cf90be26afc9efdc6c7bc096f9ad6440b7a5171e1de84b78624e9828164fcc4223f165bca2b07accd5958b8d5ce91c774474e98
-
Filesize
67KB
MD5933c630ef7dba72114b9ec2214db388b
SHA140cb9ed3abe9a3e5ee60977c9d50c6401dde365b
SHA25623e7fb2a5b16b630d8e87040e756c690cde7b61ea50e499b0ada928562c1348b
SHA51276fda58bf04c4eec78638ab3d44553e4120f61cdd6aa0da6c3b7c5633c6140a9fc759f0dbcb03983c0814431f918792ba1082c06d46053bb0cf5896c1f393351
-
Filesize
455KB
MD5eccb1f8bcae20d373b4ea2a58b9482ac
SHA1f5c5918e7b042812e667455efb4444608a2d64dd
SHA2569cb31d8b03409a37e77bf1b7ddd7a3958ca9f4921660b60568da8fa37a34dfab
SHA512a877521252884cff421d436695d3314b9a44eee685610fa5ac5c3ff5bbc260e3e4db8ca8a4d82cc953f114a2a8ca0445216a9938d6f742a48e971bf89f839016
-
Filesize
908KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
364KB
-
Filesize
908KB
-
Filesize
64KB
-
Filesize
2.5MB
-
Filesize
5.7MB
-
Filesize
960KB
-
Filesize
244KB
-
Filesize
960KB
-
Filesize
5.7MB
-
Filesize
564KB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
2.5MB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
800KB
-
Filesize
172KB
-
Filesize
244KB
-
Filesize
564KB
-
Filesize
244KB
-
Filesize
364KB
-
Filesize
200KB
-
Filesize
364KB
-
Filesize
464KB
-
Filesize
5.7MB
-
Filesize
32KB
-
Filesize
60KB
-
Filesize
276KB
-
Filesize
564KB
-
Filesize
328KB
-
Filesize
764KB
-
Filesize
468KB
-
Filesize
764KB
-
Filesize
1000KB
-
Filesize
492KB
-
Filesize
144KB
-
Filesize
64KB
-
Filesize
960KB
-
Filesize
144KB
-
Filesize
2.1MB
-
Filesize
396KB
-
Filesize
908KB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB