Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:30
Static task
static1
Behavioral task
behavioral1
Sample
7518f322490455c6035441669ef5d2cd.exe
Resource
win7-20231215-en
General
-
Target
7518f322490455c6035441669ef5d2cd.exe
-
Size
3.7MB
-
MD5
7518f322490455c6035441669ef5d2cd
-
SHA1
dc812e8139e673f093370c8367cb126f18d42708
-
SHA256
8d9114ef1e235cb35315b2c964e5ec449ff8916ac4822c0b91c84e1ac7a4c29b
-
SHA512
6f437145924397998c2c8c628950e114968844404673ca0894282a6d6aec579cfa294bc4e76fc034aae6d3c89f045014e66439fec6daaf4cfa0e495d4985a363
-
SSDEEP
98304:r8ueCsNaUBVIrwFLn355bNSo7TobePfmcCskwa:ojCsYpkBp5bNSosdXj
Malware Config
Signatures
-
Loads dropped DLL 53 IoCs
Processes:
7518f322490455c6035441669ef5d2cd.exepid Process 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe 2980 7518f322490455c6035441669ef5d2cd.exe -
Drops file in Program Files directory 2 IoCs
Processes:
7518f322490455c6035441669ef5d2cd.exedescription ioc Process File created \??\c:\Program Files\baidubar\taobao.ico 7518f322490455c6035441669ef5d2cd.exe File created \??\c:\Program Files\baidubar\qidian.ico 7518f322490455c6035441669ef5d2cd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Filesize1KB
MD5d65a94bb4cb34a12e6accf0117ab5544
SHA186c0dc01f6fa5301b9250c7d158ebe23a7fcabe6
SHA2562084eaa7c2b91ae1e6fa1253df04e68e60f6ae25a47e07a6cf68aef884dbf8f5
SHA512a6ab26b6d17a64d097e22f20ec13e1482269e1c5efd22ee1b00e01da26a061a532b13e2a46d31a781e176a72d7707300f5e0e6ba6b3e793480ff6620ec9d9202
-
Filesize
1KB
MD508297c1b75883cd5eec523f435df616d
SHA1745984b6f202d1ca0e975c97c4ab36d296f24b99
SHA256236397ce680623d3ca481b1a3f11b8535271eca868e9c6536e7b348cb4153acc
SHA512b9ffd2765f5b73cccbeaa0834ebac867fee2904d725ab2234ad7d6a6cbf1ea167894e234b8ea8c9e565cf22dc46a0824863dba29b97bed91925c97682b48e464
-
Filesize
1KB
MD50efe1829d835ecc46764832151fd2069
SHA16e2e5525797ea4f0eb94964e63670321d7c5bb12
SHA256f82ea98b1ffe870d287b22c41633694360f0b343fd7e50ae5d379c774464e92d
SHA51290c9d311c38af30162a3fee45038dc7eea101621dfab1eb7406eff8d51b0cc05eef51d97f5807f8b8e9d4813ce4ea755c322731c445ec446588256a3760c2201
-
Filesize
4KB
MD5073d44e11a4bcff06e72e1ebfe5605f7
SHA15f4e85ab7a1a636d95b50479a10bcb5583af93f3
SHA256b96b39cb4ad98f4820b6fd17b67e43d8d0f4b2667d50caa46eff44af245d75bb
SHA512e9f99b96334764ae47aa026f7f24cfb736859a9131bd1c5ec7e070e830b651787f49910911f82e4ade0dc62fea0ad54ba210b07e44830eb2be6abb710a418a98
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667