Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 17:35
General
-
Target
2024-01-25_add0c32186c6990912bc0fe959b309cd_goldeneye.exe
-
Size
180KB
-
MD5
add0c32186c6990912bc0fe959b309cd
-
SHA1
54b5d13a34914aefeee12ad82ff03a4042c384cb
-
SHA256
d26080a461a5eb56caf12e0974071d9e8615dd18b8f66f8851ca0de7f5ebb995
-
SHA512
80ded41670d213d6f6e79127027910faff01463f513ebda22336db7d2d6bdf4c72abea6395f2ba9c5b0bd1e89e13f0ad72d94ad82c6cd65f8d596825205491aa
-
SSDEEP
3072:jEGh0oLlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGpl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_add0c32186c6990912bc0fe959b309cd_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_add0c32186c6990912bc0fe959b309cd_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EBEDE7DA-727C-4ce3-A708-587CE43C9BAA}.exeC:\Windows\{EBEDE7DA-727C-4ce3-A708-587CE43C9BAA}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DBDEE1FD-7B55-4218-8BFF-D9F2778ED3CB}.exeC:\Windows\{DBDEE1FD-7B55-4218-8BFF-D9F2778ED3CB}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DBDEE~1.EXE > nul4⤵
-
C:\Windows\{5484C114-788A-401f-8C3D-2F35A4AFE27D}.exeC:\Windows\{5484C114-788A-401f-8C3D-2F35A4AFE27D}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5484C~1.EXE > nul5⤵
-
C:\Windows\{501944C8-85B5-43a4-B623-36B93ED4BC90}.exeC:\Windows\{501944C8-85B5-43a4-B623-36B93ED4BC90}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EEE588BF-7FC8-4662-8FA9-3D1B7BF05B6E}.exeC:\Windows\{EEE588BF-7FC8-4662-8FA9-3D1B7BF05B6E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7B3D3679-E182-4762-BF4C-A22B365F6960}.exeC:\Windows\{7B3D3679-E182-4762-BF4C-A22B365F6960}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0ED6BE15-A0AF-4dc3-99C3-33706D139EE2}.exeC:\Windows\{0ED6BE15-A0AF-4dc3-99C3-33706D139EE2}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A9577A9F-1AD2-4624-BB3D-FE59FFC392F8}.exeC:\Windows\{A9577A9F-1AD2-4624-BB3D-FE59FFC392F8}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{87599EBB-BA49-49d9-AE9E-729A9DD8B6C6}.exeC:\Windows\{87599EBB-BA49-49d9-AE9E-729A9DD8B6C6}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{0E09CEA0-E17D-433f-93E4-F623D7BC5D4B}.exeC:\Windows\{0E09CEA0-E17D-433f-93E4-F623D7BC5D4B}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{EF42210D-4BCA-4407-A79E-C55922CC3207}.exeC:\Windows\{EF42210D-4BCA-4407-A79E-C55922CC3207}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E09C~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87599~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A9577~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0ED6B~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7B3D3~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EEE58~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50194~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EBEDE~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD59908f74d0d9b7780819406833ae12cae
SHA14431e8c16ca05446bf90728a4cf9b45c562301bd
SHA25620ca446546ac75e942b8dcd30d3310c74e184458a8baf5d2db8563a5e3042633
SHA5126ca181af44157f5e64bb487d14d25668d99d548a8a1f7833f16bbce08bfabe37a44ecb97f0ad916d20bb58e98de20405fafa95cda305c465e9366c6c3b3520b2
-
Filesize
180KB
MD50248f610e3f0ffe02063a943ee8837df
SHA16a97700ec1bcfc99919712af39b7c7948b05e4cc
SHA256cd03fbcfa3fa15d040ffe27f3f37bb793213f19f8a812bcb16fd8d6101b548e2
SHA512767dadca0d4b541799fb696a1d1c723aba2af9ad48f7a22000c61e4e04797011b497843091d30567118ad2bf76b74b14f5e54b6b1b0c4f9c788d9fb11d4e93a8
-
Filesize
180KB
MD5873965bf2b810f5b26284771cc2d3bef
SHA102ccde98b5305b9bbf8aa4a97fc9b5e87ea35b2f
SHA256366802a39d0e44ba364f57ae1aa1b7fba8c9b5a9f438f82df8fbd3cb4ab0128f
SHA5122615db804750becb87fedc5e1ea7f6e0898d21f09a99525714a09e81018fdb70c23f6a91a7793c76eac9a3365663ea8b67fe82077b043d4e7f9e56f2ad7f6f0e
-
Filesize
180KB
MD5f39743baa977ab5965bc7fc9eb43354a
SHA1886c51904466833c26f8519fe67d3193435c0db4
SHA25686103e349071c54ae8e26ea5b1ea244e50df9292adb368cd6f95e8bceefcfe4a
SHA512e71d6bcd40492f90d5deaebf097f5e3e42c40e06b459581829750e3a90fe328a1df8d990d7c819b8c7fe9f8f2198249df7463cb22e9172eb03cdf7744a841014
-
Filesize
180KB
MD59001c3aa04b6fb097dacc749e1caf9ef
SHA19bfbba75935e416d8cd9cce7c8a756e781949639
SHA2565faf3de1f9c83b0a03a058eb16ee552e10198a1162581f0ef2f82fb8d90e9b16
SHA51297561741a7f2491f92f14b4babcc4506003ef75341892f23eadeb82e1089f252989e92a49437c481f0c428b6edbee4f1b93c2646fb1fd9eea614db1aa4aa71cb
-
Filesize
180KB
MD5b2eeecd5e72b40674da35e968edab605
SHA1162b7f27ad9b61b0287cdc2f3c2ee5eeac2d8cec
SHA2568a20ff9676013d87bd606518174840ce72d25f316add64c866923135d6b98842
SHA512912864bcd14c357e9348678fa4cbec6904e17e042953506224981dd930c2cd27bb9d0063d65cc7551752803d38e03fb16fedbd61b5c081bc33d69764732a5b60
-
Filesize
180KB
MD57142b82b5804940b6ea36bfd9ec47c1d
SHA1f9fcf5c1f3a7446e1164bbf27dff07c7a5fa37dd
SHA256875df589c297cf8a1d18fe7fb3f4c6dc7f4b2cc7c485ecde09eaddc4d78bd9d5
SHA5128b5125b0de840e76a8704db3a09ead622e0e37fc4240ae2700e921661165af36eef01a23c59fbf3174c498aba866047ab08fe2eba66151fbe82d61487e3d7db3
-
Filesize
180KB
MD56af12eac48b299460c400f6fedb8e1b0
SHA1cf8e6069f17ab15ae8cf79cc291fa3bd2f17e1cb
SHA256bb70c35a20706c99daa09f3ec586aa986224ab9659c5bea41c42a9ac397fc2f1
SHA512e3da276b9ce7c2fc47ff36398f1481e00fe33448379dccd6aa5ce22193ff9581d0cd4d374e44800460f2e99db94ba77ea1b0084ae8d1307875f786d656a271f0
-
Filesize
180KB
MD5bb36654979a5063208ef48e85d572f40
SHA12d0d4b0834692f13f4f47b4077b75b95edc07d68
SHA256aee38ce89a4d4d40388d68a53550ea62bba1afc028d341204f665d432d6c16ad
SHA512a19632097ff473b5655a8792c5cf27c37ad73909a0134f174a67a6cfe5400e45d3536c5cf97033bd0ac946a3f19e2ca0e4357b5b050218d65799c14047b43ebf
-
Filesize
180KB
MD5370b7e41dbebb78000999e034698a6cd
SHA1c236b6c9ca5742483c276c3ee90d3ec01d6b7a3a
SHA256d0241448154697cbb66560bbcc4705a2d56a1bbd3fe8153a4ee45e2bf2830077
SHA512d2875bfd2cebc2446ea89f0d7d11e82d0b206baad784b57392f7e73df3980093ff99f58d95df39ffa87d97ba1374560f169f298e336aa1f5c35cf8e001adafb2
-
Filesize
180KB
MD529e51426e844c29de1d24754fff7614d
SHA15058f7b45240dd82be09e0c51bb4bc4217728877
SHA2561c816b9af856fa7f31f4db085ab13e9d3fe5e3540fdeb416afaa5cf78e015983
SHA51200f09e915af265ab8d4c1c71eb2583f82043f2580a14ab2e36f994025f0b0c9f497dc4077db11618edfce9bba6f122e95fbe284095cf84e474e049f997bab566