e8519b26024b784cc40875d5d704a2cf66d991e3c89adf8f2b24df26b8ef71c5

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e8519b26024b784cc40875d5d704a2cf66d991e3c89adf8f2b24df26b8ef71c5.exe
Size

9.5MB
MD5

49d16500fc4fd32910a15992cdd3cd6d
SHA1

7f5222fe96ff584771d5d22304f9b0e85285acbe
SHA256

e8519b26024b784cc40875d5d704a2cf66d991e3c89adf8f2b24df26b8ef71c5
SHA512

b3db24c5e119ffe8bcc3b32b7fa65ad7f2c0b80c01bac5167e0610d4702309dac1a6c3831dd24a1d53a50e296f4bf658ff31bc57ec189ea0ba4a60b819914854
SSDEEP

196608:CUQ+W1+DZzD/Z9KuUjQTfn8LWOmYDotZgs21BRLdoQlSOLM8gYQDiymF:o+y+FzLZ9ojK8LYQotZoBRC0tL9gYQA

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2728	启动器.exe

Loads dropped DLL 4 IoCs

pid	Process
1692	e8519b26024b784cc40875d5d704a2cf66d991e3c89adf8f2b24df26b8ef71c5.exe
1692	e8519b26024b784cc40875d5d704a2cf66d991e3c89adf8f2b24df26b8ef71c5.exe
1692	e8519b26024b784cc40875d5d704a2cf66d991e3c89adf8f2b24df26b8ef71c5.exe
1692	e8519b26024b784cc40875d5d704a2cf66d991e3c89adf8f2b24df26b8ef71c5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2728	启动器.exe
2728	启动器.exe
2728	启动器.exe
2728	启动器.exe
2728	启动器.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2728	启动器.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	启动器.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2728	启动器.exe
2728	启动器.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2728	1692	e8519b26024b784cc40875d5d704a2cf66d991e3c89adf8f2b24df26b8ef71c5.exe	28
PID 1692 wrote to memory of 2728	1692	e8519b26024b784cc40875d5d704a2cf66d991e3c89adf8f2b24df26b8ef71c5.exe	28
PID 1692 wrote to memory of 2728	1692	e8519b26024b784cc40875d5d704a2cf66d991e3c89adf8f2b24df26b8ef71c5.exe	28
PID 1692 wrote to memory of 2728	1692	e8519b26024b784cc40875d5d704a2cf66d991e3c89adf8f2b24df26b8ef71c5.exe	28

C:\Users\Admin\AppData\Local\Temp\e8519b26024b784cc40875d5d704a2cf66d991e3c89adf8f2b24df26b8ef71c5.exe
"C:\Users\Admin\AppData\Local\Temp\e8519b26024b784cc40875d5d704a2cf66d991e3c89adf8f2b24df26b8ef71c5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692
- C:\梦翼极品\启动器.exe
  "C:\梦翼极品\启动器.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\梦翼极品\启动器.exe

Filesize
428KB

MD5
d00061fedb910cdce9225b1b4d2d8f43

SHA1
37ba8bebbf222b4042d70058be79c3040bb24ee3

SHA256
9fb0ccfcb57412c2b896e988b23934a14e557cb4d6e247d7d5a57c177547d163

SHA512
aa8f6398f0b233a9e3017d75d47c2e8fc09f1e56545401b206f46c0699d798b441cc49b45daf65d0f4e6423ca61f15377edbe17ec83874b36d373e2356dc7999

Download Submit
memory/2728-30-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download