Analysis

  • max time kernel
    152s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/03/2024, 22:19

General

  • Target

    660b07894dbb15e23d0fba1854641f4dd2335892bb0d23bdd9422938876271d2.exe

  • Size

    172KB

  • MD5

    d0d9ebf4b1539932a4a2469f9bf33b13

  • SHA1

    e548f87f5fdefe80a3f9fe988d960fc18e8388e5

  • SHA256

    660b07894dbb15e23d0fba1854641f4dd2335892bb0d23bdd9422938876271d2

  • SHA512

    f464637fd1cc409ec64f373fa77ab0a84cc9d5ef33a99de602f2da9b03f20327e5b6d68d52b66af9522ccd2ecec0c5703d3ac3b5f1317d7700b48b553249f28f

  • SSDEEP

    3072:+CqRckq+4xLKGPQb6pLnq1AbpaMAePjTY273c0Ii8onzK9:qjWxLKGPQbWqliA27MLsK

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\660b07894dbb15e23d0fba1854641f4dd2335892bb0d23bdd9422938876271d2.exe
    "C:\Users\Admin\AppData\Local\Temp\660b07894dbb15e23d0fba1854641f4dd2335892bb0d23bdd9422938876271d2.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Users\Admin\meoosur.exe
      "C:\Users\Admin\meoosur.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\meoosur.exe

    Filesize

    172KB

    MD5

    9127b0a3f1758f771e9a01e02c46debb

    SHA1

    e7279ffd47deb0e31ce2731026b13d5e3277afdd

    SHA256

    5f7102d65db666f0a842dbba73c919e1ae76ae6f7cf56fcd8250db23f5837bd6

    SHA512

    21090278e362bee84d7f2f0f23d44a90c8d55e15c71d4f11131ca414f8d496dc490559f0534647c04377a8680b01923e3f6b3be318d7396a58bfe787df34309a