Overview

overview

7

Static

static

3

a0c4d57435...58.exe

windows7-x64

7

a0c4d57435...58.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 15:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    a0c4d574354ef0bdbcf5a64cfa6565b1327f59764cc33465daf67f9411609058.exe

  • Size

    4.1MB

  • MD5

    b3ba22331f1cdfce94fc2b3ac790a47b

  • SHA1

    952772bd6b1be83930af5e1c826abeaecad95d3d

  • SHA256

    a0c4d574354ef0bdbcf5a64cfa6565b1327f59764cc33465daf67f9411609058

  • SHA512

    513a361038558f852b4856c99d97c64804ae45d7037b1417fd14a576b3523439351034dcfaa3bd7314eb4f140f1047af2183a60de9a2788cd0bcd7d6c67c803b

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpv4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm45n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0c4d574354ef0bdbcf5a64cfa6565b1327f59764cc33465daf67f9411609058.exe
    "C:\Users\Admin\AppData\Local\Temp\a0c4d574354ef0bdbcf5a64cfa6565b1327f59764cc33465daf67f9411609058.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\UserDotF0\devoptisys.exe
      C:\UserDotF0\devoptisys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4048

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\UserDotF0\devoptisys.exe
          Filesize

          4.1MB

          MD5

          03a49aa3a40e083f5e07601e8fff8c5b

          SHA1

          9ecaa0942ee2bdd2e9b9bc90459501af27172fc1

          SHA256

          e573f5701253d9a7643a4526bcda8c1de77280602d485319d3748316af4f9efb

          SHA512

          bc5781f43b27f89c3fe4ce5891d03772c5a3d8b132ad5f6daa63a43576c8f2aa91baa600dbf435d460b45394e111e7dfbf95f3f6c7c79200cf8ea33652413d7a

          Download Submit

        • C:\Users\Admin\253086396416_10.0_Admin.ini
          Filesize

          206B

          MD5

          df80cf4866344ea031b81524548a47f1

          SHA1

          0a167380054aa1105ebae25a9531bbced9c83376

          SHA256

          fa7e5e0a691928f359dbae85c4f6944300b2d6fc77e3439db582a5a0fdd2da8b

          SHA512

          8e5b355ae5b5b3bbe2ca89192c47ba6722b3003549fb86d972210ed40218c7dceb7661b1c19fc01cd8c2368fbd6e3f0b5e40fb272c110bab372f29e65c37920f

          Download Submit

        • C:\VidKD\optiaec.exe
          Filesize

          7KB

          MD5

          78631f73b43fa95e766280d67ae7da0f

          SHA1

          ca85fe116da7d0ee4c8d36fe1825df8c09d6829b

          SHA256

          32c0c0e722985ad4e4d7ae76467698b725193db0207c8be6bd41d5f55b187db5

          SHA512

          3bf2fce579c4792818390e3df70a9eea56371e516e574cf566a6352e2c8f91702bced60b65a6c3465c13ab588282f9b426793f38fb6e96ec23e0f0ae23450edf

          Download Submit