Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
23/04/2024, 00:59
General
-
Target
920f60bb87e6f63a202de93f1ed5bc2eaed4b9b93719c10d41c88f9c734b4aab.exe
-
Size
2.6MB
-
MD5
4f7e9f2731baff041df53f0e3dcb756f
-
SHA1
323aa384ed4f63f7cbf326d0e89e47a3ef3e7a59
-
SHA256
920f60bb87e6f63a202de93f1ed5bc2eaed4b9b93719c10d41c88f9c734b4aab
-
SHA512
1a1c2fe35083cafe1c0258e0c872e06f977a86c7bcc1bef4a55bf3c4a028fbbe8770d5bdf73f4644d3037c528893e8a646a040f8dfc548662716a7342e4e8d19
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBL9w4S:+R0pI/IQlUoMPdmpSpD4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\920f60bb87e6f63a202de93f1ed5bc2eaed4b9b93719c10d41c88f9c734b4aab.exe"C:\Users\Admin\AppData\Local\Temp\920f60bb87e6f63a202de93f1ed5bc2eaed4b9b93719c10d41c88f9c734b4aab.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\FilesQF\devdobloc.exeC:\FilesQF\devdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5a775f76d1c0159a92f9eef229fd60806
SHA1d645a3f96587e3524bd49d8dced045b167f95d80
SHA2563545baa535943c36d2dfef6e5e0cb221bc25cfebf4242f33c5816d27eefa1639
SHA512edc54bbd7d8e98a17fdc182a63708ee319a4f905cee2ed568d1eaad6b9667a26a3e76a56e6e8b49e417b3028f65a260b23ccb40fb1db6be4734c6cbfbb3637d9
-
Filesize
202B
MD547b81f3706e4ef114202c3e32e62e3b0
SHA114c418eea2c3459c4eacdc341e05acb0f5886d6e
SHA2564bb9efe8e88a1cdda93d8d50330a1e5336c68095bd36312c1d651fc2f98d1656
SHA51247b476d8c58c77c7ce7eb15ba77cd6af6e9cef14c4d22ec0379463c192c62da1705262e61f3d2374c2a4de8abad2c4164334ad5b5a8c203fda32b7d0ce1adfcd
-
Filesize
2.6MB
MD5f28f2e7e4d5b7741b2fed8aa8f88addd
SHA11381b7fb13390b54a4b9b83bc13071d2a941c2ea
SHA25699cb2a386731a22a191d66473c2f02a4ac90e87ca55f6074b9e063cb875e9094
SHA5122d718098ef808e6ad2212ce16915dde7b2a81d059b890eda444506e30585eae21fc0190d8523e3c725ed62163f43e90674be96bb163c22ce71202522a461e8bf
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB