Overview

overview

7

Static

static

3

1a8c5685cc...0N.exe

windows7-x64

7

1a8c5685cc...0N.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ty.exe

windows7-x64

1

$PLUGINSDI...ty.exe

windows10-2004-x64

1

$PLUGINSDI...de.exe

windows7-x64

3

$PLUGINSDI...de.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    112s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23-07-2024 22:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1a8c5685cc0152fe9f76a0cae0cd9140N.exe

  • Size

    241KB

  • MD5

    1a8c5685cc0152fe9f76a0cae0cd9140

  • SHA1

    d1f2d57d7e4336ea4245d4f1bb19ebf723ed1af1

  • SHA256

    3026d639ac3de01d4e8b07c5a23c76a0940d44230064ea7c988e89971e13da86

  • SHA512

    05ec5df5b216022452ba615b347b5b9dc5f7fb0591113a47920fdde7a3cdc1a17b9263f4cdc3ab4fce6d53c6c1afc48510e09f187351c0bdbe0bb92ac44165a7

  • SSDEEP

    6144:DfL+oq5k4pr3l+O/LE11c7ojuZUvyejrRj:DfLCkmI11GojuHefRj

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 44 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a8c5685cc0152fe9f76a0cae0cd9140N.exe
    "C:\Users\Admin\AppData\Local\Temp\1a8c5685cc0152fe9f76a0cae0cd9140N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2468
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2776
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3040
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:832
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2704
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:108
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2132
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2380
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2940
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1000
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2276
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2124
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2336
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2284
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2240
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1704
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2232
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:236
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1012
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1164
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:320
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1148
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:920
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2580
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2588
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2504
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2640
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2960
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2804
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:644
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2708
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2616
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2404
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:1828
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1552
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2948
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2156
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:1296
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1036
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2200
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2328
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2188
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2224
    • C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
      "C:\Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:292

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nso22CD.tmp\System.dll
    Filesize

    12KB

    MD5

    4add245d4ba34b04f213409bfe504c07

    SHA1

    ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    SHA256

    9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    SHA512

    1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nso22CD.tmp\anxiety.exe
    Filesize

    189KB

    MD5

    9101a7f1e09281d413ece6d825020d92

    SHA1

    9df34287601a77e65cec58843474108dd0309f54

    SHA256

    781c6b118a97dd0301788d1882b18242d2768ad40752cb622f70e80d7e3a0a88

    SHA512

    8f3e5068f47817593ddd3eeb48848a1a49ffbb62fbc935c3d90757625ab3aec2e19f34d45b583dbe39dbd5cad11e00e0eb888dda6ffa9952b0851d0ada616425

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nso22CD.tmp\spermicide.exe
    Filesize

    139KB

    MD5

    fda656c75b581d0dce6537d159052bcd

    SHA1

    a06523896f54e51a1a7269356634cc0bbb069edd

    SHA256

    4ce66c1b06bab37a85a93c5e7d7c9ba6f79da608fab33a00c44b8b0a9443309d

    SHA512

    8e7928c0e0439da880b7f2b036aa4f89cabb365bfe83c17184336580101c96d3b1f2c2ddc254a99a73d7cd0e203c40a1b22f68ad803070d2537c82fb95718106

    Download Submit