Overview

overview

7

Static

static

3

dff5cb1949...58.exe

windows7-x64

7

dff5cb1949...58.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    23/05/2024, 03:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    dff5cb1949740e969ab285761dd2414b33456c63c0265f25d12f5503b49fc558.exe

  • Size

    2.7MB

  • MD5

    d162fe7c9f70641f6a7b296164124e16

  • SHA1

    ea54e3f5f71c745750db5f634bb6d158c0dd7ab1

  • SHA256

    dff5cb1949740e969ab285761dd2414b33456c63c0265f25d12f5503b49fc558

  • SHA512

    83d0e00b4bc204e653fd25a893c75a4c0135f960a43e0013d6ea3f56c7094e587285d7ee2f3a800d0798501398f3e0e66813bd27560d7dc1e5fe8d43a44ae4a7

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB/9w4Sx:+R0pI/IQlUoMPdmpSp34

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dff5cb1949740e969ab285761dd2414b33456c63c0265f25d12f5503b49fc558.exe
    "C:\Users\Admin\AppData\Local\Temp\dff5cb1949740e969ab285761dd2414b33456c63c0265f25d12f5503b49fc558.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\FilesBS\devoptisys.exe
      C:\FilesBS\devoptisys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1412

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Galax5U\optidevloc.exe
          Filesize

          2.7MB

          MD5

          7b029129fd40bf533a5b1cc01455865b

          SHA1

          4320d83543d812980dcfd7162167cd64eb15d827

          SHA256

          b1339d961b489d469c8006491cde16d38a91ae321df379b77c1793ff5361becd

          SHA512

          1eb906afc928a445f3bf622382ba18605612cfee3a10eb7fd3402509fb7b21a5ba215c0017d16be82d987b419a047360e9e900a726b03494e98205f4681efbd7

          Download Submit

        • C:\Users\Admin\253086396416_6.1_Admin.ini
          Filesize

          209B

          MD5

          351443824092a6564bf3eb51d5f92e5c

          SHA1

          97a8e3e72bd8b85ca3c0437a3eadd014dc3d47c5

          SHA256

          fd5680252a9500fd6294b0551b0a9f412c171b63791925a9653f40c07929fded

          SHA512

          0c3403926465c4432dcc4cc5ff502fc2570ae99de05105d3b493ceec147443343e81c537a29dd6b9cb61db9ada7ddfebcc811850554c23301c58004f20eef8e7

          Download Submit

        • \FilesBS\devoptisys.exe
          Filesize

          2.7MB

          MD5

          e75be6beeb55dfc2b57c373e518a0fb8

          SHA1

          c109e16502d3f0523ae390f49e5c67a83451ca95

          SHA256

          7a0b7da717bc8c9ea90a6d8531997d86f36e2e18c0aa8915b78d5e07767a10fb

          SHA512

          52737deacb199f6fb63704ca853e782235a1f9e14cb8104f0beb2e0983c3379f2d289fa545a1ed2c25aea2dd48871a7aed1b7680a0de5e14bc35db8d5d5cfc27

          Download Submit