Analysis
-
max time kernel
119s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
26/07/2024, 23:07
General
-
Target
672ccd990c5fbdf1ed424c64d74458e0N.exe
-
Size
2.7MB
-
MD5
672ccd990c5fbdf1ed424c64d74458e0
-
SHA1
93fb45c439f9aba8a767bc5a9dc9abae5a349d8d
-
SHA256
552fcb950922445a3d5dfcf8526e7ac0a2e6d27ced7338078e3af1ca09f64db8
-
SHA512
6157f80f923fd4dc36d0815520fe6ea28fc9c13025013b9fe4372543fe2a580ac797b1e74af67d323dee8d69006ca879d4715acc6011a0300bbda527aaf7e8c7
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBT9w4Sx:+R0pI/IQlUoMPdmpSpX4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\672ccd990c5fbdf1ed424c64d74458e0N.exe"C:\Users\Admin\AppData\Local\Temp\672ccd990c5fbdf1ed424c64d74458e0N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\FilesWD\devoptiec.exeC:\FilesWD\devoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD58cec1ed3f2a2f2d2dd02d2dfe88fef3d
SHA15bd4e94c9afca2e825e93f352ff49a40f1e18341
SHA2563aa905feff7b76769e549976cfe1ab329601b36a7a068ffe51e26aa4b7a51bd2
SHA5120627c87cb4f71fbd5ee0679cfee0ced5a67417a8ea66624e5d0393b7ffce18b0c21655d4ea1a044c8ddf5bef5600f1c3c421548750814976be78c269ac827fdd
-
Filesize
2.7MB
MD50fe7bfe763db87a403f6bd1132221fe2
SHA11616d8784ead667d86929909fd719c6d318dab1a
SHA256c90396039f512789cd0f6a9ee7a2da11ccc03bfd5be3188c2877dd44be671081
SHA512448e9ca0e4026a75d5a89da1324b7bcb13dfec37cd8c9cd169f5b91a447e20f5195574d3e0d21b414ccb0e46f3392a01b8e083efd01ec64c263c6ab86b5f9c6e
-
Filesize
202B
MD51970a158139e9a2bd032de803b95b218
SHA1ea273399396ee45f2d8c3b41ea4508fb8cb16396
SHA25600104bf271fc605997bda0a62cde342c2dfa945659a3789d983e737189bba052
SHA51298def974c084fb7aa8a16573a7f07c3724759882efb1a2062d470a7ea7e1f89b42f9623618c984af2d967882c16ab1ca3d9f03bae7b8a9bfa319e81a6dcfc39f