Analysis
-
max time kernel
119s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
23/07/2024, 00:55
General
-
Target
3d5723529369b43fa94af174b42b1770N.exe
-
Size
463KB
-
MD5
3d5723529369b43fa94af174b42b1770
-
SHA1
482610d1d526c6ca91a15931f0b14f1d13a28e5b
-
SHA256
1de8fd83ae6b84863b0d20207f5fcef47a8c8efe7da688253516b59fb7dd133d
-
SHA512
77f9e206ce39620323d28d126be7d6eb5b3d7573578eb91fa17b99727adbd7b92516084476b4a2ac78f6ecc410ab13730edd88da24de3d2323e3f9a58859f11e
-
SSDEEP
12288:w7lc87eqqV5e+wBV6O+iPFIDq2xdL/tejL:w7SqqHeVBxnPFIpj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\3d5723529369b43fa94af174b42b1770N.exe"C:\Users\Admin\AppData\Local\Temp\3d5723529369b43fa94af174b42b1770N.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mavidVol\Passlace.exe"C:\Users\Admin\AppData\Roaming\mavidVol"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~A0F3.tmp3408 474632 4464 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\SysWOW64\backdl32.exeC:\Windows\SysWOW64\backdl32.exe -s1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
463KB
MD5c04f479b04d45c4b4d1f0cae4f26d05d
SHA14fcad6d76e07aa5c1f24470a6c0e120d6c337535
SHA256aec61848b41db7a1cebdff1ce7192f56778aebb07ee34f3e126ccb86d79492a9
SHA512d6f3d75351a8f38ac1f37cd7a44e3502c4902d89341bbbbc30dc9f40a2a2f796a42928c6cd3ed024032bfcc6de5ce224ddc256e523f0bf298ee22fe3469e1486
-
Filesize
496KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
496KB
-
Filesize
24KB
-
Filesize
524KB
-
Filesize
52KB
-
Filesize
524KB
-
Filesize
20KB
-
Filesize
496KB
-
Filesize
484KB