1473050bbfaaccabbc5429d25b37bbeaf0d73eb39706e9b01d88494704447ded

Analysis

max time kernel
71s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Windows/Email-Worm/Email-Worm.Win32.Maldal/Maldal.exe
Size

80KB
MD5

cbcd34a252a7cf61250b0f7f1cba3382
SHA1

152f224d66555dd49711754bf4e29a17f4706332
SHA256

abac285f290f0cfcd308071c9dfa9b7b4b48d10b4a3b4d75048804e59a447787
SHA512

09fdcb04707a3314e584f81db5210b2390f4c3f5efa173539f9d248db48ae26b3a8b240cf254561b0ecb764f6b04bb4c129832c6502d952d1960e443371ce2a9
SSDEEP

1536:wh6S2wzALFx8hkMsiUmxi6QPitAKQjY8c4B5h:dS212xlQvKCYx4B

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DALLAH.exe	Maldal.exe
File opened for modification	C:\Windows\SysWOW64\DALLAH.exe	Maldal.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\LucKey.exe	Maldal.exe
File opened for modification	C:\Windows\LucKey.exe	Maldal.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1252	Maldal.exe

C:\Users\Admin\AppData\Local\Temp\Windows\Email-Worm\Email-Worm.Win32.Maldal\Maldal.exe
"C:\Users\Admin\AppData\Local\Temp\Windows\Email-Worm\Email-Worm.Win32.Maldal\Maldal.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1252
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\Flopy.vbs"
  2⤵
  PID:4312

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:5164

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
PID:6136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6136 CREDAT:17410 /prefetch:2
  2⤵
  PID:3332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver65F.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\u6vsmf8\imagestore.dat

Filesize
15KB

MD5
4c3a370e60d67c0c011cb89edf286af3

SHA1
de7a70d5ebb55770478a8306ba1a1e874b4465d9

SHA256
3a37894a23b09c2a9a696cdc96bd4ba21fe014f6418fffd5d9b779a8cbee2279

SHA512
2b0a0dbe889c6c715e10cfc7ad45158a261623719172d9884cb40152c5f8c0f67f664d43ad060ab841cdce344e7c220f1c43b4d812b6a4107513d83c52064b1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XHJKUG17\favicon[1].ico

Filesize
14KB

MD5
52b5b6f3431acc1a4091ec4c29c897c3

SHA1
dd9dc4a35100ad781041df71e1fb9a3415d5fd97

SHA256
cee18f4a85d51c368fc920e7274c02a138e61eaabbcd8c91e73be29ff9931a93

SHA512
961fa8f765b8e7d6aba5f215f24baf8ebf2c5359373ac8ca508558c69a89547f3e29232a666d377ad6cbd5f3ae3675d7d85937f043113ab5099bab8e46bf36ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\Email-Worm\Email-Worm.Win32.Maldal\Sharoon 1.exe

Filesize
80KB

MD5
cbcd34a252a7cf61250b0f7f1cba3382

SHA1
152f224d66555dd49711754bf4e29a17f4706332

SHA256
abac285f290f0cfcd308071c9dfa9b7b4b48d10b4a3b4d75048804e59a447787

SHA512
09fdcb04707a3314e584f81db5210b2390f4c3f5efa173539f9d248db48ae26b3a8b240cf254561b0ecb764f6b04bb4c129832c6502d952d1960e443371ce2a9

Download Submit
C:\Windows\Flopy.vbs

Filesize
560B

MD5
24b79b368001cbe34074a2a5e67a2e06

SHA1
867a0ee94b5b2c8f54068e72de73eb819e3fa298

SHA256
19f27ae792655c4af7610272b5a05667d2d81e05a4d346abd5c35715d29e9900

SHA512
8debb8148a432cd4c906e42f5535513bd7828eb8461b0e54b7602e38c041a0421bd11c619ca7d9af8e1905cde3af27f11ba7ca220ef3b567caf48b62ebcbde3c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads