Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
24/07/2024, 02:09
General
-
Target
383a5a0e45efea070711516ecd1e96e0N.exe
-
Size
2.7MB
-
MD5
383a5a0e45efea070711516ecd1e96e0
-
SHA1
fa6df52784be6fe19d375d2a49d647d508ce6dd3
-
SHA256
e7b046eeac4fed422dd9dd3cac1415ac2c33b804a1c2119cc202e81b1d4451b8
-
SHA512
70cd77446555bca5c2fd1a616322ecf5fbb8b543921f8500c56d758f40a614431856387a5d2589d4e5d937ec297b0318f7fcf98b14aa9c07d43d80572fbd3417
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB99w4Sx:+R0pI/IQlUoMPdmpSpp4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NTFS ADS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\383a5a0e45efea070711516ecd1e96e0N.exe"C:\Users\Admin\AppData\Local\Temp\383a5a0e45efea070711516ecd1e96e0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\IntelprocIA\xbodec.exeC:\IntelprocIA\xbodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5fcc2aaba4a09f2602337e2f2f610b343
SHA17fd8439dbe06d137e0b9c71942a54ed28d085348
SHA256bd6c217a6c61e950015029e912cec97b044770225f4b873243eeabc3f1f25ae0
SHA5126aad6cc0af8f241a61a78b5a190045f979ca969f0f2e03c961bb698b4f0ff6957714dc9125c9beadc7f3977489b4de6a7448eb151efd654ab4d627b044026c7a
-
Filesize
204B
MD5d2fc07162572bd53fed1f2096071f1e5
SHA11c1016f5f6099773af25d3547b4afe443861f9c0
SHA25602cc7e48c6719b22c2c1b1f479b341f57568c9f437a90aa38c8dd02dfa76908e
SHA512a6959bd2651d594d79cfc494eedf0e492dc08be5f01431af21af60376397e1a1581d22ff1ba26c184bca92db89a7a1bde0f81206c9a06526ce465f636a5eea3d
-
Filesize
2.7MB
MD5cb5d4af5a30b6944bf7c50032199b699
SHA11acb44032dc547f8cad21504a14a224cc1019662
SHA2561cd69709975a1a8504994ab6764b8a15388659cfce0e4f59958fb2710f4500f1
SHA512347a89c5dab9fcc0af87ed4e5e9c6f5ec48254d12bdb2322f571dcc0102b214aaf22fddadc3317d30d99040d12307fa1cefb3fa4cf91dc6a0b57efa0ac8ff5f2