Overview

overview

7

Static

static

3

09399b1d84...a8.exe

windows7-x64

7

09399b1d84...a8.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    152s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2024, 18:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    09399b1d842e8228010c2f7c6d7c04dbc9d91b36a821d826c4574b7504d61fa8.exe

  • Size

    2.7MB

  • MD5

    c9fb1bd52bc6d90f400c96d09cc2953f

  • SHA1

    1f9cf04f490f8cafcfe27a4296a2b4c053941bcc

  • SHA256

    09399b1d842e8228010c2f7c6d7c04dbc9d91b36a821d826c4574b7504d61fa8

  • SHA512

    0fc55d0208cc4152dad8af612fca69c92c51e7265c03d1333fa1184e1c63e0506107feefb9dcc195a067ac04384d79c35dc07055876a9a9806847a4a286ca575

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBe9w4Sx:+R0pI/IQlUoMPdmpSpg4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09399b1d842e8228010c2f7c6d7c04dbc9d91b36a821d826c4574b7504d61fa8.exe
    "C:\Users\Admin\AppData\Local\Temp\09399b1d842e8228010c2f7c6d7c04dbc9d91b36a821d826c4574b7504d61fa8.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:864
    • C:\Intelproc7Y\aoptisys.exe
      C:\Intelproc7Y\aoptisys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2372
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2988

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\GalaxE8\boddevsys.exe
            Filesize

            1.0MB

            MD5

            783947ee4f02f0b04706f55b50e8b702

            SHA1

            9b4784ee72b875383da0458e3fe5590f77a8de5a

            SHA256

            6d88831f2bb562a3779b9dea8fb0190a60133645752f9aa90358944a6dcd254d

            SHA512

            db6f7577fa6faf88d1a23765d3be1c1cc214db01c39be80df89f3e7473740fb9051b3d06ec29770d27ab9aa9857ec34bbf1303d72d3b50b681dea85ef903614f

            Download Submit

          • C:\Intelproc7Y\aoptisys.exe
            Filesize

            2.7MB

            MD5

            7820cf49483aec8e8a56924679310825

            SHA1

            1d489b90a1a19e65df2fd8401ba3fccc2a9eaa01

            SHA256

            2c6f947add60ded31734ad7489ae6c13fd174a19c882151b0e63d1f83b2c4809

            SHA512

            fc8f3e7d91c0d2bcca4206229f8c24eb121cc3e8c1e131d01e91fa50049d9fbe3d0151417589c12ac43980150471914b07d999aaf599386a35279befe739bc65

            Download Submit

          • C:\Users\Admin\253086396416_10.0_Admin.ini
            Filesize

            207B

            MD5

            e4e8252b3ad33adf95e7e65b047a186c

            SHA1

            4cb8292746ebe8d647b6e2137b972d989b765463

            SHA256

            db53b4d3c91f1d73a1884e110a9a800c380e8ca52e7d1f69a45fe02a45f25db9

            SHA512

            9be0cffd56d1488380a55eb00c06a1c2dfd0ca21dadc38279dd562b9ce879e606e2a4fc8fa8b1c1cf50c4440dd64861c22b25069eadf1d887c09579ef599de3b

            Download Submit