Analysis

  • max time kernel
    149s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-03-2024 20:38

General

  • Target

    MyMalwareDatabase-main/MyMalwareDatabase-main/Frog.exe

  • Size

    5.2MB

  • MD5

    6128546e25df18564f28f6d593c51d76

  • SHA1

    b18cdfcb8ea1b70a08ce9925ab0f4ed99ce5c50a

  • SHA256

    c99f3878b0b04624af3c1c452a4f9a86d3ef0496383f9f173587cf6f14eae55a

  • SHA512

    019a3bdce86e5e5c374502a761855f577f8d742932e86f5d85ca4975c41ac94378a7d5c07e8a357c6e0de7f114914d8666780fa3f4b09a85a902fcf24cf32a35

  • SSDEEP

    98304:OZEVrN/30MkE0bGDdFXm3BpqZdolLF4axzDPv9uVlDD23iX8pbelR00:OZcrh3D0iD7mpqZdolLXzTvytwm1

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MyMalwareDatabase-main\MyMalwareDatabase-main\Frog.exe
    "C:\Users\Admin\AppData\Local\Temp\MyMalwareDatabase-main\MyMalwareDatabase-main\Frog.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Users\Admin\AppData\Roaming\1337\Frog.exe
      "C:\Users\Admin\AppData\Roaming\1337\Frog.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nso8FDE.tmp\System.dll

    Filesize

    11KB

    MD5

    2ae993a2ffec0c137eb51c8832691bcb

    SHA1

    98e0b37b7c14890f8a599f35678af5e9435906e1

    SHA256

    681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

    SHA512

    2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

  • C:\Users\Admin\AppData\Roaming\1337\Frog.exe

    Filesize

    4.3MB

    MD5

    41e75c80873b0ca18d56ddaba4c5aadd

    SHA1

    1d0423d6e66a4739db22939e1c16bcdc7eaa9746

    SHA256

    b7d4eef3fa0244a3618b3d60eab9a3ebaf1f8ec5cce9598d37e99b9d7a988cec

    SHA512

    402de19c72015fefefe02347fad8907762c991538c4ef7aa6b646c90d6fd7aadadcdb8be9f03d78a1b7cec712516faa318fde738b52dfa7b3aaa34219f2d1530

  • C:\Users\Admin\AppData\Roaming\1337\Frog.exe

    Filesize

    1.3MB

    MD5

    498b332266cedcf8cbd7567c4a39bcbd

    SHA1

    281331dc3fcdc6a821c4b15e71b7bd41603534ed

    SHA256

    aea78dc8b3d694a84f73eb3ff8c366874d81f74e46e92b67d12aab112f58fff9

    SHA512

    6abbd75cc70adf6acb10bca9d981f9eb62ccaf9125ad721fb3668d99220e70fd24467badc65168e88cbcb2850e15e294843d0b231897597239126bc9d00022f7

  • C:\Users\Admin\AppData\Roaming\1337\php5ts.dll

    Filesize

    6.5MB

    MD5

    c9aff68f6673fae7580527e8c76805b6

    SHA1

    bb62cc1db82cfe07a8c08a36446569dfc9c76d10

    SHA256

    9b2c8b8c4cec301c4303f58ca4e8b261d516f10feb24573b092dfccc263baea4

    SHA512

    c7836f46e535046562046fdd8d3264cd712a78c0f41eab152c88ea91b17d34f000e2387ded7e9e7b3410332354aabf8ca7d37729eb68e46ab5ce58936e63ac56

  • memory/1732-27-0x0000000000400000-0x000000000064F000-memory.dmp

    Filesize

    2.3MB

  • memory/1732-30-0x0000000000400000-0x000000000064F000-memory.dmp

    Filesize

    2.3MB

  • memory/1732-25-0x0000000000400000-0x000000000064F000-memory.dmp

    Filesize

    2.3MB

  • memory/1732-26-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/1732-19-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/1732-28-0x0000000000400000-0x000000000064F000-memory.dmp

    Filesize

    2.3MB

  • memory/1732-29-0x0000000000400000-0x000000000064F000-memory.dmp

    Filesize

    2.3MB

  • memory/1732-24-0x0000000000400000-0x000000000064F000-memory.dmp

    Filesize

    2.3MB

  • memory/1732-31-0x0000000000400000-0x000000000064F000-memory.dmp

    Filesize

    2.3MB

  • memory/1732-32-0x0000000000400000-0x000000000064F000-memory.dmp

    Filesize

    2.3MB

  • memory/1732-33-0x0000000000400000-0x000000000064F000-memory.dmp

    Filesize

    2.3MB

  • memory/1732-34-0x0000000000400000-0x000000000064F000-memory.dmp

    Filesize

    2.3MB

  • memory/1732-35-0x0000000000400000-0x000000000064F000-memory.dmp

    Filesize

    2.3MB

  • memory/1732-36-0x0000000000400000-0x000000000064F000-memory.dmp

    Filesize

    2.3MB

  • memory/1732-37-0x0000000000400000-0x000000000064F000-memory.dmp

    Filesize

    2.3MB