Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 17:43 UTC
Static task
static1
Behavioral task
behavioral1
Sample
medik.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
medik.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
sign.exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
sign.exe
Resource
win10v2004-20231215-en
General
-
Target
sign.exe
-
Size
15.9MB
-
MD5
4f63aebfcbeeb6a580e13bd81d4c8a19
-
SHA1
00143c99571ec2cdef358a19215acc49e92488bd
-
SHA256
bb4a96deea854f3a23aa87497b76a2bcba165c7d3b60617dc2b222a6475235d5
-
SHA512
406d40fbe820ebd924064e7043f7cd817fc047ccbddcec79c848489f027b865c324051500e961a21400dc57a2e37655a52afc2b59db9c8fd291068f2743152e5
-
SSDEEP
393216:65crRz8IBR1bKCHGuUVLIRfiXbVqRelD:PVzfRlzHTgLq2VMU
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3792 sign.exe 3792 sign.exe 3792 sign.exe 3792 sign.exe
Processes
Network
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.178.17.96.in-addr.arpaIN PTRResponse198.178.17.96.in-addr.arpaIN PTRa96-17-178-198deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request67.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request28.160.77.104.in-addr.arpaIN PTRResponse28.160.77.104.in-addr.arpaIN PTRa104-77-160-28deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request200.178.17.96.in-addr.arpaIN PTRResponse200.178.17.96.in-addr.arpaIN PTRa96-17-178-200deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request200.178.17.96.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request179.178.17.96.in-addr.arpaIN PTRResponse179.178.17.96.in-addr.arpaIN PTRa96-17-178-179deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request154.141.79.40.in-addr.arpaIN PTRResponse
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
198.178.17.96.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
67.31.126.40.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
232.168.11.51.in-addr.arpa
DNS Request
232.168.11.51.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
171.39.242.20.in-addr.arpa
DNS Request
171.39.242.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
28.160.77.104.in-addr.arpa
-
144 B 137 B 2 1
DNS Request
200.178.17.96.in-addr.arpa
DNS Request
200.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
179.178.17.96.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
154.141.79.40.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD57df3e7f582228a72ac26744c80fc5f90
SHA103b52cb4962e69c3fc0ad47db1a676d463ea090c
SHA256dcd22183888779174553cdc257d24d6d9f354f8003ad6d064527faa2871db60c
SHA5122a1dd6f7b35749e6af3476338c6957d5eeb1c6950926ba99948c1d2fd495252a97de2c63221e535eb43843a6938571d7dd23e1b1f75a883b904271245fb2a44c
-
Filesize
28KB
MD5269b45a27ffad49047f26e279abd0cf6
SHA1ba95e308b1972af2de688ddd4687276782395625
SHA256e534686fe8c6f55d183802eb0cda2ab512f14cf42dbd449e317785c046b899d9
SHA512758c9f3fe9832a4cabddc26f77957027be48889ff0244dac91d610c2a6fc144f8ed43354ceee78bf1771bad5e8e0f88e91504fe5439cfb7cd6d76dbcaa3a0473
-
Filesize
28KB
MD5467f77c16ac7d42c26c657fad557e204
SHA11e1ec3176af201e8052d723342ba1fb3b4bb30f5
SHA256b6fec76634d486e084ef39b2491b9740cf0a5249d622aa2550754169819873b2
SHA512e563f25432b8a53140a6e23e894a7716853a63718863425508f55a23f8a79652539c2dd82691f2e73e0fc951a18844340609d7120f0ee6bd5d3f3423b19109b5
-
Filesize
383B
MD570673f5bc61d79295a1b271d90546b00
SHA18b42af24701c0bf0b8002b2f93eec1af1aacfd39
SHA2563a0b57fe08524b3856db06d397e5d7614056f5a96f671e6e850a6b1dd3697266
SHA51229f2b92ffa84b69567fce742d95d714d861ac7723267b76227ef2dc32d5ed68bb25e3274cc3b3b84054d591c4cbb7560c0970029ec72d18c9ecaae3c1410372d