Resubmissions
22-04-2024 22:02
240422-1xtwbagh68 1022-04-2024 19:25
240422-x42b7afa68 1019-04-2024 03:02
240419-djmthsfh8w 10Analysis
-
max time kernel
1466s -
max time network
1500s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
22-04-2024 19:25
General
-
Target
11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432.exe
-
Size
14.4MB
-
MD5
ecaa6f88c3b6594914a8ffde04fd5d84
-
SHA1
885e4370299d369f7285ba5f2c544cbcd70a5fd0
-
SHA256
11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432
-
SHA512
94712c9ceddc1e2abd7ec19dc39bf2cbea54d3430f66887e2e0861c2cdb4c4ee24c39d3140c9374e826049516b814c3fcfcf4c49402bc5c2335d87bc0ee67f83
-
SSDEEP
393216:hp8QGQCKH9iqYCfy8tW5MrYR0aioa4CMRmrrCZRBkyQzy:v8QGrK5GXR9ioaJMRmrrdysy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432.exe"C:\Users\Admin\AppData\Local\Temp\11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GUBootService.exe"C:\Users\Admin\AppData\Local\Temp\GUBootService.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fahu.au3C:\Users\Admin\AppData\Local\Temp\Fahu.au34⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5cd1838cf69d2b756935dd4f5eebdb327
SHA17e927a1e0e8558b73b1811d052d755e3759f7893
SHA256fb6c72547f3b34569b6b4624371c253325603412a3420db03d8ad5298094f65f
SHA512f1784200aeae346155d839272acb351c3fac59d421cd53ed60fe5686164ec948e5f8f0c8d564dd69211c5bd12bcf42f22a32a992d931c0efa2c6e894162fe79c
-
Filesize
925KB
MD50162a97ed477353bc35776a7addffd5c
SHA110db8fe20bbce0f10517c510ec73532cf6feb227
SHA25615600ccdef5a64b40d206d89234a51be1e11bd878dcefc5986590bcf40d9d571
SHA5129638cab1aabe78c22a3d3528a391544f697d792640d831516b63fa52c393ee96bb588223e70163d059208cc5a14481c5ff7ef6ba9ac572322798a823d67f01f5
-
Filesize
11.5MB
MD54a053e8f03eba1dd6fcd28aeea8dc05f
SHA1080d5f4b1c1e892658672aded073b70dfd14f7de
SHA2566a5cc7a1803b002e91129d9317fa8f2d79fc07775ded7163c38d41569f8068ed
SHA51232e3cc6fbb5db6b38c5aa18b3bb077c9e03e218d3698d6a30a6e62bfcba2692d4b625b286df0604637a5a7488d8215406c46f337f8ca908081b300a58945de3d
-
Filesize
2.0MB
MD5d2235aeb97c1be6fbdd13517579bcbf9
SHA1335abcda67ceab10c96bf4855642e031d65aa282
SHA256fa699bcb14ae008a91105ab5ba25744e1f16420b95c628ce21329b285cee511a
SHA512e4fcedf30de47a134d77ebd245c1e4036c8cdffdea84a44dad982e5c62346fc8ff304266e8b62d190159c5c6619d1bf5dc1ff8d70e73f78d56015d6f661c2041
-
Filesize
308KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
308KB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
4.1MB