Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
25-06-2024 23:07
General
-
Target
38ea43399444c3c7c561ec560bb2f94b0403a40be687f40e06ca2f42f81b225a.exe
-
Size
9.0MB
-
MD5
70989a4909e55f0a3a9983c56734309d
-
SHA1
72a6d0688d3dce6607c1a2e30ab2b74f388f5c75
-
SHA256
38ea43399444c3c7c561ec560bb2f94b0403a40be687f40e06ca2f42f81b225a
-
SHA512
15e29a99a6f00744ea52fdc6b0e61c5128ecc5e84b70b4de17e0efd763dcf535dfd054b10333c7a18eeeae29f51d32c3506b8b3ae3c6c2c5ea91f6a0df46feb5
-
SSDEEP
196608:gqKoYXKWUGNEoiN/A4sT+HwmiIl0MyoNQJl85wzQd+c:5P9pGNvT+ziI/NNxd+c
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38ea43399444c3c7c561ec560bb2f94b0403a40be687f40e06ca2f42f81b225a.exe"C:\Users\Admin\AppData\Local\Temp\38ea43399444c3c7c561ec560bb2f94b0403a40be687f40e06ca2f42f81b225a.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\38ea43399444c3c7c561ec560bb2f94b0403a40be687f40e06ca2f42f81b225a\38ea43399444c3c7c561ec560bb2f94b0403a40be687f40e06ca2f42f81b225a.exeC:\38ea43399444c3c7c561ec560bb2f94b0403a40be687f40e06ca2f42f81b225a\38ea43399444c3c7c561ec560bb2f94b0403a40be687f40e06ca2f42f81b225a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68B
MD53b44299823fb0b103b4ef1a85811aa7f
SHA1cbe8ee1798c2dd42a2dd5c4bd8463c6caf0808b1
SHA256b6cd16222d1be7d8ee7ff719dfe7d42ab7c81bd6a0f2f8d008941396c629a064
SHA512f89c0b6172830c10877c50c02f96aeec50d076cf72d5440560c4f117c6ab0738fe35b9eb9bde434e4d04bd898d8b6455050946eb7a75fc0a92da7c75486a1b21
-
Filesize
102B
MD56fead1ffbe89193f7bd18aeb3946951d
SHA1ae1d700b3fb18081294229ffc382bb63c615f06b
SHA256f3fc1dd0bbff8ab7a89a1979b29b6bfb8c0929afd0ba7e35d2c76db26e19d84b
SHA512a6a9ffc5a41688c1988e43ced1f9cc460ffe313bd0051696ade64dba2969a6e962761dd7d021018fdf7969ba76e3eadb1213a5077ec93c46ac5245d7125cd5b8
-
Filesize
9.0MB
MD570989a4909e55f0a3a9983c56734309d
SHA172a6d0688d3dce6607c1a2e30ab2b74f388f5c75
SHA25638ea43399444c3c7c561ec560bb2f94b0403a40be687f40e06ca2f42f81b225a
SHA51215e29a99a6f00744ea52fdc6b0e61c5128ecc5e84b70b4de17e0efd763dcf535dfd054b10333c7a18eeeae29f51d32c3506b8b3ae3c6c2c5ea91f6a0df46feb5
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
3.8MB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
3.8MB
-
Filesize
3.8MB