Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11-03-2024 00:18
General
-
Target
bede30fbc43e3c050c95d919b5c617e11fd3c0757461291b562a4aba7f195470.exe
-
Size
464KB
-
MD5
abc4c9705c66ca5e1f1dcfede06a3faf
-
SHA1
7f5981ea756a40e449e4b1f3df0000f8d519500a
-
SHA256
bede30fbc43e3c050c95d919b5c617e11fd3c0757461291b562a4aba7f195470
-
SHA512
91766684b84230e71ab405d3e9aef35dea259f6387b5a39539c5350e02db586f130673d2c63183b5e29c0e6844bb2700245ebc0dc2e193f3d330548e2a349039
-
SSDEEP
12288:7Mlc87eqqV5e+wBV6O+01m8uB1TF0G+7aLH+7xorW:7MSqqHeVBxZ1m3F0G+7AH+tx
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\bede30fbc43e3c050c95d919b5c617e11fd3c0757461291b562a4aba7f195470.exe"C:\Users\Admin\AppData\Local\Temp\bede30fbc43e3c050c95d919b5c617e11fd3c0757461291b562a4aba7f195470.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dcomcont\conveown.exe"C:\Users\Admin\AppData\Roaming\dcomcont"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~6D82.tmp1200 475144 2744 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\SysWOW64\fltMexer.exeC:\Windows\SysWOW64\fltMexer.exe -s1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
464KB
MD557d99d327c8013c0125972416dbd8b8b
SHA130a70307bba40299a2443a8c10b0ee57deca3568
SHA256b048869c514e579306ba51f3f9cf6ff11acdcf454ffc1f42897dbfab8bd81a8e
SHA5123b879b17b9839db8a9eb077a0344d8c2626a8b04372f9bc528b8869c1fea3abcafbfeece74c8cb87f034511c6c47ebcd9e44c11bad7e7a91901dd14dd2f5199e
-
Filesize
528KB
-
Filesize
528KB
-
Filesize
528KB
-
Filesize
24KB
-
Filesize
52KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
500KB
-
Filesize
488KB
-
Filesize
20KB
-
Filesize
488KB
-
Filesize
500KB