Overview

overview

7

Static

static

3

e6d53ac5ef...24.exe

windows7-x64

7

e6d53ac5ef...24.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2024, 07:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    e6d53ac5ef252724c4c78d76c90f3dc27c202e93295e77e0c3e4f338d068bc24.exe

  • Size

    78KB

  • MD5

    68a4c0a0db78f940847ff0f2dd0b90e2

  • SHA1

    e0e5be0ca98e7f67d4c0b6667c82ce933d1d1cb3

  • SHA256

    e6d53ac5ef252724c4c78d76c90f3dc27c202e93295e77e0c3e4f338d068bc24

  • SHA512

    1da928e80a844e7f1da27feb022c012a263bbb13850fb75096621fb39888794567a124545f673c798267585e4a7da9e91bd8c5eae4e2433e4847cbc4f9ea50e0

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOd5NIV:GhfxHNIreQm+Hiq5NIV

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
    persistence
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6d53ac5ef252724c4c78d76c90f3dc27c202e93295e77e0c3e4f338d068bc24.exe
    "C:\Users\Admin\AppData\Local\Temp\e6d53ac5ef252724c4c78d76c90f3dc27c202e93295e77e0c3e4f338d068bc24.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:4688

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\notepad¢¬.exe
          Filesize

          76KB

          MD5

          dca6e4406f121f9a10a14bfc8a0e0f9a

          SHA1

          c0270ade02db75fb00a8aa61024eddacfafaac55

          SHA256

          4ba26e0403c860d219ab4fa2f72251b89ef6d67fadbc813ceb0956e691365f98

          SHA512

          7aa78638ce4b474d808c875cc76c6c9d7e84cb4b547dcbb2a4b990e7613dd374c07bd44a3d13d52ce2f6980ae55024208b8c36cec94e0d89a304916d718b8c41

          Download Submit

        • C:\Windows\System\rundll32.exe
          Filesize

          77KB

          MD5

          ceed904138b2e84fd4137c3e0edb0435

          SHA1

          cede694f6d6edf366021ea23c47a4de2c1090806

          SHA256

          179dc87bf9ebf980e89889cbd41e6b783df673c3e8be95c611081a2756a518ab

          SHA512

          4b2746c1b1d6e5a08890ee47897b9076600aa819023eb6b60d24e036923f23b71a7716f9c659b6a45c7cb6da9a98fde64123ddc4a1532cc0aa7bfae88f1c90e9

          Download Submit

        • memory/2284-0-0x0000000000400000-0x0000000000415A00-memory.dmp

          Filesize

          86KB

          Download

        • memory/2284-13-0x0000000000400000-0x0000000000415A00-memory.dmp

          Filesize

          86KB

          Download