5ad9bb5e9520e7020fc005e34f858c96f1bc7599c1bd4e488673c66988cd11b0

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ad9bb5e9520e7020fc005e34f858c96f1bc7599c1bd4e488673c66988cd11b0.exe
Size

1.7MB
MD5

87d9573e69cacc6cdce5f42911dfd67e
SHA1

caa4882385f71398d8152f745847c8b7626afa72
SHA256

5ad9bb5e9520e7020fc005e34f858c96f1bc7599c1bd4e488673c66988cd11b0
SHA512

4cd71cb2d7fb57236d7d8b19b14fbfcb0507479c8dd11a550c095883c2c3cbf3ff3001645ca156d3b6cc63601f184c7077184114e1610d837cd8eb8575438f21
SSDEEP

24576:lsSxAkbu8KHEhrUFWpvYja/YdcziBSzY4uMpy9oCUyHXUVCvOroAg:lsSS8KkhIWpvYTIiBS4Yy9hUQUH8A

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2604	5ad9bb5e9520e7020fc005e34f858c96f1bc7599c1bd4e488673c66988cd11b0.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	5ad9bb5e9520e7020fc005e34f858c96f1bc7599c1bd4e488673c66988cd11b0.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\qxgnia.dll	5ad9bb5e9520e7020fc005e34f858c96f1bc7599c1bd4e488673c66988cd11b0.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2604	5ad9bb5e9520e7020fc005e34f858c96f1bc7599c1bd4e488673c66988cd11b0.exe
2604	5ad9bb5e9520e7020fc005e34f858c96f1bc7599c1bd4e488673c66988cd11b0.exe
2604	5ad9bb5e9520e7020fc005e34f858c96f1bc7599c1bd4e488673c66988cd11b0.exe

C:\Users\Admin\AppData\Local\Temp\5ad9bb5e9520e7020fc005e34f858c96f1bc7599c1bd4e488673c66988cd11b0.exe
"C:\Users\Admin\AppData\Local\Temp\5ad9bb5e9520e7020fc005e34f858c96f1bc7599c1bd4e488673c66988cd11b0.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Fonts\qxgnia.dll

Filesize
1004KB

MD5
1938bc501c2cbaacdd8e4a1fe4441b53

SHA1
7894d0d1f00d8293913392601fc8af07015f4945

SHA256
57252baf752a552e600a7a86d0040c44822de3b3fe7ca42f873501bb643e92fe

SHA512
b8ddd2d3e5df03683de540fdb720dca47c545e1877727474559576664d226b0c2dc713f6afb98b95f1150bb2ac8f65d33b3446530d2c9cc8fe0b0ecf25380212

Download Submit
memory/2604-3-0x0000000010000000-0x0000000010114000-memory.dmp

Filesize
1.1MB

Download
memory/2604-4-0x0000000010000000-0x0000000010114000-memory.dmp

Filesize
1.1MB

Download
memory/2604-5-0x0000000010000000-0x0000000010114000-memory.dmp

Filesize
1.1MB

Download