Analysis
-
max time kernel
165s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11-03-2024 00:18
General
-
Target
bede30fbc43e3c050c95d919b5c617e11fd3c0757461291b562a4aba7f195470.exe
-
Size
464KB
-
MD5
abc4c9705c66ca5e1f1dcfede06a3faf
-
SHA1
7f5981ea756a40e449e4b1f3df0000f8d519500a
-
SHA256
bede30fbc43e3c050c95d919b5c617e11fd3c0757461291b562a4aba7f195470
-
SHA512
91766684b84230e71ab405d3e9aef35dea259f6387b5a39539c5350e02db586f130673d2c63183b5e29c0e6844bb2700245ebc0dc2e193f3d330548e2a349039
-
SSDEEP
12288:7Mlc87eqqV5e+wBV6O+01m8uB1TF0G+7aLH+7xorW:7MSqqHeVBxZ1m3F0G+7AH+tx
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\bede30fbc43e3c050c95d919b5c617e11fd3c0757461291b562a4aba7f195470.exe"C:\Users\Admin\AppData\Local\Temp\bede30fbc43e3c050c95d919b5c617e11fd3c0757461291b562a4aba7f195470.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\fontethc\Picktar.exe"C:\Users\Admin\AppData\Roaming\fontethc"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~9769.tmp3196 475144 5544 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\SysWOW64\cmstvert.exeC:\Windows\SysWOW64\cmstvert.exe -s1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3100 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
464KB
MD5759224cece82fb85106cfe382864a583
SHA152057d841aab6392fbd4508123502b6feef9d6f5
SHA256c3c4f4911e123bda30b890bd5004c8ad05108e1a17e672734301464c7bc72ec6
SHA512a81a9a2ab066cc1352eb690e4df1e7c5e063efb55bd4f5274fc3655a2cecb5e712c9c97bdea51775453527956e8d342f8e1e6f752220f9440790b94b3b4d44a3
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
24KB
-
Filesize
52KB
-
Filesize
528KB
-
Filesize
528KB
-
Filesize
500KB
-
Filesize
20KB
-
Filesize
488KB