Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
19/07/2024, 02:45
General
-
Target
424aa2e69d7bcff960e025ccd10d62c0N.exe
-
Size
469KB
-
MD5
424aa2e69d7bcff960e025ccd10d62c0
-
SHA1
70c9a619520afc85d1567bbb77659ea24933dea4
-
SHA256
d3da2040db9b038830c6b53e6dc53975608778ddcf66a47827f1dd7403479a0f
-
SHA512
9c29e95c5c70bf40cc6aee969f6eaab374937b5192509c2543eae72fc77b49a9509875d7aaa189544408f0174fa415b3fc338cf193e0fa504b75e8ed0ae2277e
-
SSDEEP
12288:u9lc87eqqV5e+wBV6O+ahq5UNuGKgaVg510Ru:u9SqqHeVBxDq5UNuFbVg0u
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\424aa2e69d7bcff960e025ccd10d62c0N.exe"C:\Users\Admin\AppData\Local\Temp\424aa2e69d7bcff960e025ccd10d62c0N.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ktmuINFO\dcomkmgr.exe"C:\Users\Admin\AppData\Roaming\ktmuINFO"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~A737.tmp1200 480264 2536 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\SysWOW64\drvill32.exeC:\Windows\SysWOW64\drvill32.exe -s1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
469KB
MD5019ee5c3e86bc0d2261b0cb352e9870a
SHA1a6bcdc4b6d7f187874ebd5f815fe681137a8a397
SHA2566b9b361f879ca38d6c01110aadf2cc14a001243f68146426ba04799b78a7ec81
SHA512962960d6c723ed182011e5f3bdd9a7117cdcfd7b67100627b404677c6fa02d68991302434a377d0823f4ddbfbb72019579bb2efa99e9696992b5ed134b835bbc
-
Filesize
532KB
-
Filesize
52KB
-
Filesize
532KB
-
Filesize
24KB
-
Filesize
532KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
20KB
-
Filesize
504KB
-
Filesize
512KB
-
Filesize
504KB
-
Filesize
512KB