Analysis
-
max time kernel
119s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
25-07-2024 22:23
General
-
Target
1bf41032c1daf5cf7e267088ea9da290N.exe
-
Size
2.7MB
-
MD5
1bf41032c1daf5cf7e267088ea9da290
-
SHA1
6fe512f6576485fae55f4caecee44ada495ed56f
-
SHA256
f33dc1e2115014cae48d49eb39c2c566c24d1261e698b3c8b07acb1c6dedfe9a
-
SHA512
1b46f8c32c70111a829c4c2d621c98c29bb31a6a4d2e8f5bced8d33e31cc539cdf3e9b9b44dd4fd836c10f0a48620fd40af65b83881cd82f9d102f4fa963fe85
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBT9w4Sx:+R0pI/IQlUoMPdmpSp74
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bf41032c1daf5cf7e267088ea9da290N.exe"C:\Users\Admin\AppData\Local\Temp\1bf41032c1daf5cf7e267088ea9da290N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\SysDrvIU\devbodec.exeC:\SysDrvIU\devbodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5c723285412abeb859bd10e5b437bcabf
SHA12b943627077b3b4c70da489692d73112e3d82617
SHA2561b84b4d6f206c1da3b9f8d879018352217b8d3c47205e4df57a32ccb5441e359
SHA51299231be7052e73f94146d69361fbf07b2b3d1613ef528e32c8140c3c7ef3f0e0c133f7662760cd7200744e6525fb5843f2db71047d68cc8753bddcb21c0c73c2
-
Filesize
2.7MB
MD5adddb1f0b52320341bcd064b976b3b3b
SHA1416d1195c449fe1c32166065542f7256c899c087
SHA256a57df91db07012fca6955c8a0cdedaa4706ed264f5918ba7e997072f228dca26
SHA5127dff4ebcb283c5a0a9e1ab9db2f2b1620ed51c33a211bb777d3cbdfe60f0d67dfcf22dd28685b27aa4d01806f515a0eeb47e443a95e47f68cdc2b6052c304e7b
-
Filesize
205B
MD5a6938213c7f52a6dff4892e435fbb498
SHA16b00365a70f70b5fc41802f190975ad38d42632f
SHA25669dccfbd6ab36a78e9358410d5bb7351f3a62669d62f3b29ea731fd817b3445d
SHA512786acc3f59d825e2a1fe6c989e0910b828458497f9f1d1fde23944da34cce1f90c72e9e937512685f92bb37eef58ff0bfa6a8bb23b3bca07727d724f6b675d5e