Analysis

  • max time kernel
    135s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2024, 12:11

General

  • Target

    eee_payload.exe

  • Size

    261KB

  • MD5

    ee73e48395918fc324d655c14482effd

  • SHA1

    d177209785824724c4786c14995d1726b16f76ca

  • SHA256

    d4dfb7228adfd937f59d1e4cd050cdfe3e24e18dbe24eda9b2c01ea51c664ff4

  • SHA512

    56d10c4003bc51dc9daaa1c2610e20af14c9059ede6bd5394f22833adbeef25b5cb55fbb4cc0735d644375f01de779442066e257b77709e93eec6af92a231002

  • SSDEEP

    6144:MDKW1Lgbdl0TBBvjc/28EfxpAG9FuEIB61Q:ah1Lk70TnvjcO8gxjFuEIB6m

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.kino2.top
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ]]KMGj9lIqJ#

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\eee_payload.exe
    "C:\Users\Admin\AppData\Local\Temp\eee_payload.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1604

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1604-0-0x000000007519E000-0x000000007519F000-memory.dmp

          Filesize

          4KB

        • memory/1604-1-0x00000000024D0000-0x0000000002524000-memory.dmp

          Filesize

          336KB

        • memory/1604-2-0x0000000075190000-0x0000000075940000-memory.dmp

          Filesize

          7.7MB

        • memory/1604-3-0x0000000004BF0000-0x0000000005194000-memory.dmp

          Filesize

          5.6MB

        • memory/1604-4-0x0000000004B10000-0x0000000004B62000-memory.dmp

          Filesize

          328KB

        • memory/1604-33-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-24-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-34-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-67-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-170-0x0000000075190000-0x0000000075940000-memory.dmp

          Filesize

          7.7MB

        • memory/1604-65-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-63-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-59-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-57-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-55-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-53-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-51-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-49-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-47-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-40-0x0000000075190000-0x0000000075940000-memory.dmp

          Filesize

          7.7MB

        • memory/1604-30-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-28-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-26-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-18-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-16-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-14-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-12-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-10-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-8-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-69-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-61-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-45-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-43-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-41-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-38-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-36-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-22-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-20-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-6-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-5-0x0000000004B10000-0x0000000004B5D000-memory.dmp

          Filesize

          308KB

        • memory/1604-1037-0x00000000052A0000-0x0000000005306000-memory.dmp

          Filesize

          408KB

        • memory/1604-1038-0x0000000075190000-0x0000000075940000-memory.dmp

          Filesize

          7.7MB

        • memory/1604-1039-0x0000000006390000-0x00000000063E0000-memory.dmp

          Filesize

          320KB

        • memory/1604-1040-0x0000000006430000-0x00000000064CC000-memory.dmp

          Filesize

          624KB

        • memory/1604-1041-0x0000000006550000-0x00000000065E2000-memory.dmp

          Filesize

          584KB

        • memory/1604-1042-0x0000000006640000-0x000000000664A000-memory.dmp

          Filesize

          40KB

        • memory/1604-1043-0x000000007519E000-0x000000007519F000-memory.dmp

          Filesize

          4KB

        • memory/1604-1044-0x0000000075190000-0x0000000075940000-memory.dmp

          Filesize

          7.7MB