Overview

overview

10

Static

static

3

32e191494c...20.exe

windows7-x64

10

32e191494c...20.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    82s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2024, 20:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    32e191494cff56cda80e73beb14a412b1a7623b2dcefb51ea07c5fc8b2861020.exe

  • Size

    76KB

  • MD5

    8f7141c14542d9d446c0b164d4546b22

  • SHA1

    548f95ce309af2c92c63c28aadbfdff2eeb65754

  • SHA256

    32e191494cff56cda80e73beb14a412b1a7623b2dcefb51ea07c5fc8b2861020

  • SHA512

    b3b68fdb8d4edfbda399fea18a58af6193810f65817b3748b55ce0f7b1ffb752e4485f4339fe89e178e929e40a43e024e0ed896a5fe25e0d4ac82a48ad64df2c

  • SSDEEP

    768:94IrCa3GJE5q/e6+xOF4/i/BEYkp7P6lweQDhDmpU5GFrrEzWsdSE0d8pUHIkI0d:9VEJE5qGxO+2G40OIkaBy

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\32e191494cff56cda80e73beb14a412b1a7623b2dcefb51ea07c5fc8b2861020.exe
    "C:\Users\Admin\AppData\Local\Temp\32e191494cff56cda80e73beb14a412b1a7623b2dcefb51ea07c5fc8b2861020.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Users\Admin\levoh.exe
      "C:\Users\Admin\levoh.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\levoh.exe
    Filesize

    76KB

    MD5

    075b3cc72a35bdab6e558fc094175291

    SHA1

    dca09badd4ba8d8cb11c8aaa433ac4784063e63c

    SHA256

    be0e99068f390a74af326c45073e97ba1343dc69fb0a930b5822fc53c4998556

    SHA512

    53f757357d9ee9d7ee494f4ae56aad5b7944a20fff87ec03c7f08927d05373f5ef5df3d3d77d7575204ae4b8ab2adb64876cbf1d651d090ebb1573b234a0316c

    Download Submit