Analysis
-
max time kernel
1480s -
max time network
1504s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
14-05-2024 15:20
General
-
Target
dos.exe
-
Size
10.7MB
-
MD5
b9edb20d757647075b1567a7613da435
-
SHA1
493a7fbb0ef5a0532bf86b73862928193237ca86
-
SHA256
0c54ba8280050a8c912c787a135cb0cacb7d318469ab6a5666d26286243b047c
-
SHA512
20e77cb998b964ebac67eed9770c24eae47a2f216f10931a93da4a0053d21819fd5c9e461ba9f38763dbf0c16b5b1e1560eb29eefed13d3dfb218943e4da4d0d
-
SSDEEP
196608:3QjGe9D0yvvXx103lz1CB+ClrT21xkg1zwomHZDFFXaxQzJCG4kRHlsTIulJa/:3QjGe9AyH/Ufmna7kgtwomHdqG9akDsj
Malware Config
Signatures
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 17 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dos.exe"C:\Users\Admin\AppData\Local\Temp\dos.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\onefile_5048_133601907213960469\dos.exe"C:\Users\Admin\AppData\Local\Temp\dos.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5b4ff25b1aca23d48897fc616e102e9b6
SHA18295ee478191eb5f741a5f6a3f4ab4576ceec8d2
SHA25687dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
SHA512a7adcf652bc88f8878dae2742a37af75599936d80223e62fe74755d6bafaafd985678595872fb696c715f69a1f963f12e3d52cd3d7e7a83747983b2ee244e8a2
-
Filesize
77KB
MD5b77017baa2004833ef3847a3a3141280
SHA139666f74bd076015b376fc81250dff89dff4b0a6
SHA256a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
SHA5126b24d0e038c433b995bd05de7c8fe7dd7b0a11152937c189b8854c95780b0220a9435de0db7ac796a7de11a59c61d56b1aef9a8dbaba62d02325122ceb8b003d
-
Filesize
174KB
MD50f02eccd7933b7a7c2bdedca2a72aab6
SHA10b4c551d8fe34d8128e5cf97daa19eb4c97db06e
SHA256ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678
SHA51290a64082dab51380e05c76047ee40e259c719d7170fb4acb247b68a03b710461b350da3821b426fd13167895ded32f9c5ec0e07587ad4125683a18a3495f5ed5
-
Filesize
5.0MB
MD5e547cf6d296a88f5b1c352c116df7c0c
SHA1cafa14e0367f7c13ad140fd556f10f320a039783
SHA25605fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
SHA5129f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
-
Filesize
768KB
MD519a2aba25456181d5fb572d88ac0e73e
SHA1656ca8cdfc9c3a6379536e2027e93408851483db
SHA2562e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
SHA512df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
-
Filesize
29KB
MD5e4ab524f78a4cf31099b43b35d2faec3
SHA1a9702669ef49b3a043ca5550383826d075167291
SHA256bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
SHA5125fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee
-
Filesize
512KB
MD5dc08f04c9e03452764b4e228fc38c60b
SHA1317bcc3f9c81e2fc81c86d5a24c59269a77e3824
SHA256b990efbda8a50c49cd7fde5894f3c8f3715cb850f8cc4c10bc03fd92e310260f
SHA512fbc24dd36af658cece54be14c1118af5fda4e7c5b99d22f99690a1fd625cc0e8aa41fd9accd1c74bb4b03d494b6c3571b24f2ee423aaae9a5ad50adc583c52f7
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
801KB
MD5d9fc15caf72e5d7f9a09b675e309f71d
SHA1cd2b2465c04c713bc58d1c5de5f8a2e13f900234
SHA2561fcd75b03673904d9471ec03c0ef26978d25135a2026020e679174bdef976dcf
SHA51284f705d52bd3e50ac412c8de4086c18100eac33e716954fbcb3519f4225be1f4e1c3643d5a777c76f7112fae30ce428e0ce4c05180a52842dacb1f5514460006
-
Filesize
82KB
MD5aa1083bde6d21cabfc630a18f51b1926
SHA1e40e61dba19301817a48fd66ceeaade79a934389
SHA25600b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
SHA5122df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c
-
Filesize
155KB
MD5b86b9f292af12006187ebe6c606a377d
SHA1604224e12514c21ab6db4c285365b0996c7f2139
SHA256f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
SHA512d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312
-
Filesize
31KB
MD57f52ef40b083f34fd5e723e97b13382f
SHA1626d47df812738f28bc87c7667344b92847fdf6a
SHA2563f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c
SHA51248f7723a8c039abd6ccb2906fbd310f0cfa170dcbdf89a6437dd02c8f77f20e6c7c402d29b922cdaabd357d3a33e34c3ad826127134f38d77a4d6d9c83371949
-
Filesize
10KB
MD5723ec2e1404ae1047c3ef860b9840c29
SHA18fc869b92863fb6d2758019dd01edbef2a9a100a
SHA256790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94
SHA5122e323ae5b816adde7aaa14398f1fdb3efe15a19df3735a604a7db6cadc22b753046eab242e0f1fbcd3310a8fbb59ff49865827d242baf21f44fd994c3ac9a878
-
Filesize
116KB
MD59ea8098d31adb0f9d928759bdca39819
SHA1e309c85c1c8e6ce049eea1f39bee654b9f98d7c5
SHA2563d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753
SHA51286af770f61c94dfbf074bcc4b11932bba2511caa83c223780112bda4ffb7986270dc2649d4d3ea78614dbce6f7468c8983a34966fc3f2de53055ac6b5059a707
-
Filesize
16.3MB
MD5b94f46a9ccfa747560cace715d1f35e5
SHA1ec5ca0dfd61c60bfc57274a9a21f8bace7a12c25
SHA256905992c5cc2ce29eac193a498bee88853b13ac897542533556373e5af802a392
SHA5128f14c5d93c7454034ea7913a248ae6a863a0c44d057b3e77827b73a2e4a729e654e125f6764396d9766313f991fd72a1d74d2334b9272d315806a23be5f51e0d
-
Filesize
5.5MB
MD5387bb2c1e40bde1517f06b46313766be
SHA1601f83ef61c7699652dec17edd5a45d6c20786c4
SHA2560817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
SHA512521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
-
Filesize
1.1MB
MD5fd9132f966ee6d214e0076bf0492fb30
SHA189b95957f002bf382435d015e26962a42032cb97
SHA25637c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02
SHA512e35729abc45e5561aae1fb9e0e7c711dd7d3c1491520aa5c44fcc50c955f549f81d90897959327e930d02a5356afe08d6195adf002c87801a7a11235670639b5
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
10.8MB