Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 18:43
Static task
static1
Behavioral task
behavioral1
Sample
04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295.exe
Resource
win10v2004-20240508-en
General
-
Target
04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295.exe
-
Size
5KB
-
MD5
93d31b97555fed253eb666b32510b9b2
-
SHA1
ab0247ed3e1b99b5157697dd64734928d02651f9
-
SHA256
04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295
-
SHA512
0eb5d9e07f80fee441ba18f0c2585e1175654f428affedb974395fb4dc2ae5f411ad15d9e8cd7c8777d6f67b3112a182294ff9ce4f4fb0426732e09464fe6510
-
SSDEEP
48:6hecFbLUTctoGevLHmCyYymx7RfMRNptUzEVnQBG/RACalGUF2CS7DD0//YX:QUYtevLGayMUXptwAnQWRRUF2CqD0YX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
kdeohw.exepid process 2128 kdeohw.exe -
Loads dropped DLL 2 IoCs
Processes:
04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295.exepid process 1232 04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295.exe 1232 04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295.exedescription pid process target process PID 1232 wrote to memory of 2128 1232 04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295.exe kdeohw.exe PID 1232 wrote to memory of 2128 1232 04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295.exe kdeohw.exe PID 1232 wrote to memory of 2128 1232 04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295.exe kdeohw.exe PID 1232 wrote to memory of 2128 1232 04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295.exe kdeohw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295.exe"C:\Users\Admin\AppData\Local\Temp\04649c0a877ac6fa6d3388376df7a558d4151f81ef0eed781e6f3b541c328295.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\kdeohw.exe"C:\Users\Admin\AppData\Local\Temp\kdeohw.exe"2⤵
- Executes dropped EXE
PID:2128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5cb565232cf4b5ad157feeb9b22e0faa6
SHA10e40f1ba04a01332db9f3194f1678712804f5da4
SHA25671b258ef903c71b3fd5c2dbdfb837abf987d8dd7dc1dee39c459697a1c427e74
SHA51245ae76cdc0dfc139e87eff85c5a6fd12cd1615a3e3897606235d98df4930536885255fb650d5e67bedbae5b2f48d38e9be3124fa5d58398885a32d46f212e8c9