Overview

overview

10

Static

static

3

ec83e3eeca...18.exe

windows7-x64

10

ec83e3eeca...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-03-2024 00:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ec83e3eecaf4499f826c23bf6db957c5eab48a4f4f2cc6a7c3919722e0514b18.exe

  • Size

    256KB

  • MD5

    afdd4138cb4467fe560df27e84191cd5

  • SHA1

    efe7fc89599c2194e8a38b36f939507ab9792848

  • SHA256

    ec83e3eecaf4499f826c23bf6db957c5eab48a4f4f2cc6a7c3919722e0514b18

  • SHA512

    bcbcab1c2646b7c64f54d5de747c32e314ff833219dd545f755184fca65cf27926a3214cfef5db4d5fe48d74ddf775daa3218ab564b09a4f01820c7a54de04fc

  • SSDEEP

    6144:pvg18eNTb/UoKHU8iN2iYty5Y+tG91K09YEuOFcU0b:pvg1JxVSU8iN2iYty6+tG91yEuOdq

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 54 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec83e3eecaf4499f826c23bf6db957c5eab48a4f4f2cc6a7c3919722e0514b18.exe
    "C:\Users\Admin\AppData\Local\Temp\ec83e3eecaf4499f826c23bf6db957c5eab48a4f4f2cc6a7c3919722e0514b18.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Users\Admin\roolic.exe
      "C:\Users\Admin\roolic.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:4492
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    PID:3672
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    PID:3904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\roolic.exe
    Filesize

    256KB

    MD5

    43d82d982dcf6e80f039dc6545313706

    SHA1

    edb5d6a6840aea4fae95ad9289e5dddaaa52aa9d

    SHA256

    71117ae7bb462652d956c10313bae3f210c26a7d82302a9014d4006704eaeef3

    SHA512

    a33f7c152f420090e39ac0a7da1fd2f38eb2739f0a8adcc31f3aececbdc97627c6c92e42edb7ba47ca452f3e26d98e24a84a6534511619b7cce8b2b7b47b898b

    Download Submit