Analysis
-
max time kernel
142s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09-06-2024 06:58
General
-
Target
bin/Gajim.exe
-
Size
373KB
-
MD5
33a90bd70e8bf2527df9f25a0d8168f7
-
SHA1
e642ffbab5e091814ad21d769ab13144d651db15
-
SHA256
4135679db5005bd78bd9207c4c430522a1581da4a80895518deb62a987117ca6
-
SHA512
ce1835811133a605ce4978eed37ee63fb59f27b05bbcfb6ca1256c084cb1f0b472c76d95d4135790779d97b97fad57bd0cc8500b978130acaa10cb52e7213ece
-
SSDEEP
6144:oLY6SNR6nMFeqY+gPe8TxMm1D+9gYuHBaez0q5ItWxL+dxLaJDBjmZ88N+ZdbAi:ISNq8eqY+gPe8TxMmx+9gYuHBLz0aItV
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bin\Gajim.exe"C:\Users\Admin\AppData\Local\Temp\bin\Gajim.exe"1⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bin\gdbus.exe"C:\Users\Admin\AppData\Local\Temp\bin\gdbus.exe" _win32_run_session_bus2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78B
MD5c11510f0492465607a6fcbb202a84ac3
SHA119f6ec13aa516442d9e67f26f616ef39b8b14906
SHA25629692277cd288e9eb580a39decb4ece8bb791b4953f5288734603cef2a42494e
SHA512b528e1d041c94bbb7d0134bf487eae1507ab4c8095b80339cd395657cfe16a7524b0497cc6f2482c140cee8d7923fc7f17b232c027a531295f22d2c07b28c110
-
Filesize
16B
MD593be2e8c2346c3b4ea8ff8a4e93063a0
SHA169c309b2df331b7da97083f2c1e3cbb797a812f3
SHA2560ab57ce5f43853cc047b87af0a71fad8cd0f7459981cc1ad881e223a1554c5e6
SHA5121b72da72fded361636e6e7c1d181d17497dc53056d1b5d4ab9a18184b837ad98b9a886c8b5353fd60d1dada190d099c06725e127c9c04974af0e32e0546b2478
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
124KB
-
Filesize
1.2MB
-
Filesize
52KB
-
Filesize
1.3MB
-
Filesize
2.0MB
-
Filesize
68KB
-
Filesize
104KB
-
Filesize
68KB
-
Filesize
60KB
-
Filesize
84KB
-
Filesize
180KB
-
Filesize
7.2MB
-
Filesize
116KB
-
Filesize
128KB
-
Filesize
96KB
-
Filesize
192KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
176KB
-
Filesize
400KB
-
Filesize
1.9MB
-
Filesize
148KB
-
Filesize
52KB
-
Filesize
72KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
216KB
-
Filesize
180KB
-
Filesize
176KB
-
Filesize
88KB
-
Filesize
212KB
-
Filesize
268KB
-
Filesize
704KB
-
Filesize
784KB
-
Filesize
348KB
-
Filesize
1.9MB
-
Filesize
1.2MB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
412KB
-
Filesize
60KB
-
Filesize
1.1MB
-
Filesize
1.3MB
-
Filesize
176KB
-
Filesize
360KB
-
Filesize
252KB
-
Filesize
336KB
-
Filesize
212KB
-
Filesize
124KB
-
Filesize
144KB
-
Filesize
1.5MB
-
Filesize
168KB
-
Filesize
108KB
-
Filesize
80KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
1.7MB
-
Filesize
76KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
88KB
-
Filesize
136KB
-
Filesize
404KB
-
Filesize
64KB