Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09-04-2024 20:29

General

  • Target

    d76c621627f68dac1ef331645cc01945.exe

  • Size

    135KB

  • MD5

    d76c621627f68dac1ef331645cc01945

  • SHA1

    feda4aa837cb658878609fd04825491f8124862e

  • SHA256

    6e16a5f5ff6469a917c7eaf5d2bc1074d868d32ec00393a91c42d58ea12e1fad

  • SHA512

    47dc3ccfb37e14819650c053a205f18dd49d3ff911c42dcd6bece3efa348cd1cdc42e0f9a7ebc8e13cb50da379ecf73e912fef1f2ad314be2c9eecccedb9ea66

  • SSDEEP

    3072:q4/k7OsnNUPb1WpXVxAaGBvbNvNbNJkvmhyPQbaDTUXGIDbwKDqCtrwdAxaVTtVi:FQOs8oIDbByGPMsMP

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d76c621627f68dac1ef331645cc01945.exe
    "C:\Users\Admin\AppData\Local\Temp\d76c621627f68dac1ef331645cc01945.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Users\Admin\feodi.exe
      "C:\Users\Admin\feodi.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\feodi.exe

    Filesize

    135KB

    MD5

    3531e14906901ebb9b02f3e4c8824e1d

    SHA1

    07405ac1c09191b4cb2aeaf511fc78f6cf07652a

    SHA256

    a59479320df835f618c04d74539e648d76d8d153c23a05d60af9d3bf366ff489

    SHA512

    7432f80c67bde13a71aa7c7cc0426f1b48c417f098ea591b7f2129c43b439db5f787848c661f021caf77c8e9199c8a1e3c465da2cc4e06acf99c1763465c8566