Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
27/07/2024, 05:42
General
-
Target
f0185337545467d44a3eaddaf40d543045591c29ad81599e10db58239330ce95.exe
-
Size
3.1MB
-
MD5
0ac1f6f935c1e9c94f39c2fdddc1d293
-
SHA1
3151872d050a0265dc5481c04fc7a29f41c4fa98
-
SHA256
f0185337545467d44a3eaddaf40d543045591c29ad81599e10db58239330ce95
-
SHA512
39bfab2926b968b5434e1ee982e58ad7705ec1810de1a262c9544b4a362f2230aee635fbb6ecb690743ff0813f1020da99ad038ac8a26e67aefde36abecb6304
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBv9w4Su+LNfej:+R0pI/IQlUoMPdmpSp74JkNfej
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0185337545467d44a3eaddaf40d543045591c29ad81599e10db58239330ce95.exe"C:\Users\Admin\AppData\Local\Temp\f0185337545467d44a3eaddaf40d543045591c29ad81599e10db58239330ce95.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Files29\devbodloc.exeC:\Files29\devbodloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD58bf7abc9763a086301ef07b7ccbc88a2
SHA1387af1126859efaa6c46a9eede215a0973d24ee5
SHA2569ca7a74b2734690da0afd97f7c9c31ddb427868091233aba8bc96f0afe0c9a10
SHA512deb50317e6d2fb24650e6988632be108062baae704c0e51e7b8bb9bc33e49d5eb2d7542cc48da573f0dc38f0ffdee06144dd7f0748bf922e9ef3b169b58921d7
-
Filesize
206B
MD505d0680be7419780f77de456b0cb4e85
SHA1231c3d8cbf0068d308f5e59e298f26cd6f62d0ae
SHA256ad547ea9de81cc12297080f6c6d4a5ca0df4c749b593ce4f9a0965c8fcba48e4
SHA512b40176e04f4acba94c024a9ec93e0124ab55c6f46a79b0a294798c04bc1efcee657d4af0b9bf1dff27bfeee556fc3b39db80f3662a4ea7e7f426fedcf4b2cb7c
-
Filesize
3.1MB
MD5a5fb41cc2d980083c87621804b1ba68f
SHA1f0c3b2156072566a75b8d56c042114e035cb6db0
SHA25631c81646ae942181804ee48ca4e4ab20b0a1e40bacc431480cbbc489490c4986
SHA5122d25ff4767f61eaa7e67ea3b0aa681fcef93cb04f4e33ecb497afc258cc92a95ffd30cf90825ad65888d641ff3063d17b8809ec0cc31f9ca2d8345145310fceb