Analysis
-
max time kernel
120s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
24/07/2024, 02:09
General
-
Target
383a5a0e45efea070711516ecd1e96e0N.exe
-
Size
2.7MB
-
MD5
383a5a0e45efea070711516ecd1e96e0
-
SHA1
fa6df52784be6fe19d375d2a49d647d508ce6dd3
-
SHA256
e7b046eeac4fed422dd9dd3cac1415ac2c33b804a1c2119cc202e81b1d4451b8
-
SHA512
70cd77446555bca5c2fd1a616322ecf5fbb8b543921f8500c56d758f40a614431856387a5d2589d4e5d937ec297b0318f7fcf98b14aa9c07d43d80572fbd3417
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB99w4Sx:+R0pI/IQlUoMPdmpSpp4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NTFS ADS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\383a5a0e45efea070711516ecd1e96e0N.exe"C:\Users\Admin\AppData\Local\Temp\383a5a0e45efea070711516ecd1e96e0N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Files1O\aoptiec.exeC:\Files1O\aoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5887a791f48d401ebb879a6cb86a78906
SHA11d9489e33607489ee9a54a213fa11a8e88a4d503
SHA256189c7afb61ab23c98dff814d5a3b4cc3adedbd146133dc949f70be15c5bdd0a2
SHA512bae5425659cf9fd4cc25a64ad22ea479a20698d5ca0aea0eeb3eeb99e8a5ef7b9f51b3201133627f782f49dfbb5a304af1129cca49d460e44ea378798e8f4855
-
Filesize
2.7MB
MD56f2d70e8bbdbd1852770e6efbe27f5e8
SHA17cd3fea429ff4fcb146a24f668fe240ecbe856be
SHA256b32febf4fab6776aff372dc600de795956f44e2d0a86b0050cd62046850a1466
SHA512aaa78dbd4459374016bc20726d8acbbd9f23ba8e41e19efa8737f6a328591476ee3eacded9afa59afd0dd5b7bb5163cceb761fc93ca3b3faaafbee5563ecbcbf
-
Filesize
200B
MD51e4c082677e3802ab07a355f991111ee
SHA176453897cd307c7617f08211e3a9786cc865bdc9
SHA256a31d3bec1c8ba4ba3dd0810941a027065fd5916e76db72a9ca095388d14ddfc1
SHA51264d53da5c2d90b96bc6777aa09e7ae2f5742924ad5b6520dcdfe07deb985e8a7c02d8f14e3e1d8ef832ce366e2ba77abbff2f774fdd4225d4333b4b4aadc5697