7f77e3fcc3789c8bb2aff6bcd8b25fd575e615bb50fbd9328e404dd1cc41edc1

Analysis

max time kernel
92s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aa0bfa2a66ac906ce4805abc00fb4982.exe
Size

955KB
MD5

aa0bfa2a66ac906ce4805abc00fb4982
SHA1

604382fd16029e37615f592f07c86ce4fd6f4161
SHA256

7f77e3fcc3789c8bb2aff6bcd8b25fd575e615bb50fbd9328e404dd1cc41edc1
SHA512

104c61cd43300254c20ee0fe17cddc7e3feee9ea6fdcc7187233ce2aadf2ad0a9343020e7580596f933c4f4e827f62f3cb01c5e7e5d1bcba0bb805bf8276cde2
SSDEEP

24576:LFtiJgJBteczX6XswGX8hcIF4gN8BoYU/q:uJm6GX8hcI96t

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3888	DomaIQ10.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3888	DomaIQ10.exe
3888	DomaIQ10.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 3888	4952	aa0bfa2a66ac906ce4805abc00fb4982.exe	91
PID 4952 wrote to memory of 3888	4952	aa0bfa2a66ac906ce4805abc00fb4982.exe	91

C:\Users\Admin\AppData\Local\Temp\aa0bfa2a66ac906ce4805abc00fb4982.exe
"C:\Users\Admin\AppData\Local\Temp\aa0bfa2a66ac906ce4805abc00fb4982.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\DIQ\flashplayer_151\DomaIQ10.exe
  C:\Users\Admin\AppData\Local\Temp\DIQ\flashplayer_151\DomaIQ10.exe /path="C:\Users\Admin\AppData\Local\Temp\aa0bfa2a66ac906ce4805abc00fb4982.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DIQ\flashplayer_151\DomaIQ10.exe

Filesize
340KB

MD5
dfe97aeef7e4bb36a261406bfb2db452

SHA1
f683c4b4c286b4c8dbcb809a4e676b43ea872e5b

SHA256
eafa2798644ec67fc72b1690e35b6ba2f73d759821f406c827b9f1543ef0d0d7

SHA512
9710067c7efe56b89b0540b19f39cb93794e13aee760ebf8ec3c5c4d546acada0741dcd9760f8ece6e4c64f42da5d0d28381b528c03c9fd6451eae3f05b6ef83

Download Submit
C:\Users\Admin\AppData\Local\Temp\DIQ\flashplayer_151\config.dll

Filesize
36B

MD5
02f6e45f4408f64951806d585e6e9c4a

SHA1
864ac959cfbcae1513fbf399c151cacfd83daeb3

SHA256
8bc898ba04219478b52197de2cb44de8fd26fda76f838531eaea44d24257126d

SHA512
31e4017a9b5e7fce76d650c7916926e8319a2bc55e2c00af8685234943c734b7a5765185dd959f69cf4c4b53186a522dc4e434dc22a7b1001738493954ea60cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\DIQ\flashplayer_151\routes.dll

Filesize
257B

MD5
8fc132d017671cb9f0322ef97411aed7

SHA1
ec7587f1ce58736442912f1152fcc76c735eb26c

SHA256
a5d0ce7bd7d4c43cb49c2a76ceef62fe78733c22ad6132da73a871f29aeb5280

SHA512
2d5145b253ca05f3b28bb35dac53611cb7513b0502f01307cd47e592789abe85f68e6c8a312e5b319a34a0e10be6fb60b42cbf0b6084c43a07fdb96196192d37

Download Submit
memory/3888-15-0x00000000016A0000-0x00000000016B0000-memory.dmp

Filesize
64KB

Download
memory/3888-17-0x00000000016A0000-0x00000000016B0000-memory.dmp

Filesize
64KB

Download
memory/3888-12-0x000000001C330000-0x000000001C7FE000-memory.dmp

Filesize
4.8MB

Download
memory/3888-13-0x000000001C000000-0x000000001C09C000-memory.dmp

Filesize
624KB

Download
memory/3888-14-0x0000000001660000-0x0000000001668000-memory.dmp

Filesize
32KB

Download
memory/3888-11-0x00007FF9F6420000-0x00007FF9F6DC1000-memory.dmp

Filesize
9.6MB

Download
memory/3888-16-0x00000000016A0000-0x00000000016B0000-memory.dmp

Filesize
64KB

Download
memory/3888-10-0x000000001BC90000-0x000000001BCA0000-memory.dmp

Filesize
64KB

Download
memory/3888-18-0x00000000016A0000-0x00000000016B0000-memory.dmp

Filesize
64KB

Download
memory/3888-19-0x00000000016A0000-0x00000000016B0000-memory.dmp

Filesize
64KB

Download
memory/3888-20-0x0000000020830000-0x0000000020892000-memory.dmp

Filesize
392KB

Download
memory/3888-9-0x00000000016A0000-0x00000000016B0000-memory.dmp

Filesize
64KB

Download
memory/3888-8-0x00007FF9F6420000-0x00007FF9F6DC1000-memory.dmp

Filesize
9.6MB

Download
memory/3888-25-0x00007FF9F6420000-0x00007FF9F6DC1000-memory.dmp

Filesize
9.6MB

Download