Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
28/02/2024, 13:51
General
-
Target
cuenta iban-ES65.exe
-
Size
814KB
-
MD5
daeeb64bc3b2ca69d5062b932d9f5486
-
SHA1
d958e304dbd45b11f414034799e005510ff2d94d
-
SHA256
8634a3db542e996337729ffab3913e48633f6422d1cde9a6f743a42a3bf75679
-
SHA512
6db8fc36dfd4b0ce9c4e15f27c25760cd361f78bffbc8e39796f846f324b58fb90800fe9ca6c1f2e35f415ae7ba880730aeaa4a90621bb1634b7c12e04742d0a
-
SSDEEP
12288:6JTQdb6aT/+OkC2WOPASrfuhheB0IyXUJW+QiAukU30+9Ir/CSQC:mTQdb6aTfkC2WOIOI4qIwUk+T/G/CA
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cuenta iban-ES65.exe"C:\Users\Admin\AppData\Local\Temp\cuenta iban-ES65.exe"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cuenta iban-ES65.exe"C:\Users\Admin\AppData\Local\Temp\cuenta iban-ES65.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\rasautou.exe"C:\Windows\SysWOW64\rasautou.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1332 --field-trial-handle=2268,i,8796662530135712346,11409037572378858775,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
50B
MD570345464ba62a9453db2f24c1bc10881
SHA162fe4814d1b6082b46c196734b9eaf33b9b691bb
SHA256cc7e912d757a17a09ced10401c69d122b7972d4f9f6e26705e18a8cfe3ebef40
SHA512b0ed1640898ebf66797489862be3acdff589b161106c688e0536cabd91f673a75126a70b9363b078d8c88144d547ded4e8980e457c8e75e1477aadbb5414ae3a
-
Filesize
1.1MB
-
Filesize
144KB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
3.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
24KB
-
Filesize
1.1MB
-
Filesize
856KB
-
Filesize
856KB
-
Filesize
856KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
3.3MB
-
Filesize
256KB
-
Filesize
652KB
-
Filesize
256KB
-
Filesize
652KB