Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 10:12

General

  • Target

    E-dekont_pdf.exe

  • Size

    542KB

  • MD5

    95456fdd4cec234b22658709cafdff50

  • SHA1

    da417e45e3136848914e0004b2f0ac4a50168d58

  • SHA256

    77f75d57217646debafefa81bb803dbabb9cbd67c8f99c4906ab91843e42a1b7

  • SHA512

    0d03d8d5f44fa64a1ffda60477387f5d302d4192e548e87974cc52f707bf423a3bb628dee9e6c9b2adb044610374e99eeaff693f2c01438f702d4b1d8dfa57bb

  • SSDEEP

    12288:eGLutMahZo88x1jWAIxqlD0hh3zPIrZLbDSf:eGLAXZ+xlWAqe4CZLbDc

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\E-dekont_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\E-dekont_pdf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Users\Admin\AppData\Local\Temp\E-dekont_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\E-dekont_pdf.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nso36FF.tmp\System.dll

    Filesize

    12KB

    MD5

    4add245d4ba34b04f213409bfe504c07

    SHA1

    ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    SHA256

    9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    SHA512

    1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

  • memory/2960-19-0x0000000077AC1000-0x0000000077BE1000-memory.dmp

    Filesize

    1.1MB

  • memory/2960-20-0x0000000074925000-0x0000000074926000-memory.dmp

    Filesize

    4KB

  • memory/4560-21-0x0000000077B48000-0x0000000077B49000-memory.dmp

    Filesize

    4KB

  • memory/4560-22-0x0000000000820000-0x0000000001A74000-memory.dmp

    Filesize

    18.3MB

  • memory/4560-24-0x0000000077AC1000-0x0000000077BE1000-memory.dmp

    Filesize

    1.1MB