Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    31-07-2024 19:46

General

  • Target

    x360ce.exe

  • Size

    3.1MB

  • MD5

    b6e5bd3c6abd734ac9d66f7dbcdb8409

  • SHA1

    485e46c4dcf4d1274eae63932c024bdf9fc52e34

  • SHA256

    28e424c515f3724c872fc1d5d79709fa9d13e7986c47fb678b90a677a225abf5

  • SHA512

    2e825c315db6761af99385d6be13308bc0f111d024b8a0e9e22d806d54b8312c1864f08799b73ee7b441719fb81d57000cfc5ce7ddc118745ca41226858db67b

  • SSDEEP

    49152:0NbfJJb4/WGdvbKJJb4/WGBJJb4/WGwJJb4/WGA0wr+jTZtaZ3Otfj7UCLiJJe4f:oXbbG5mbbGVbbGobbGABr+dCe6GC

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\x360ce.exe
    "C:\Users\Admin\AppData\Local\Temp\x360ce.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\X360CE\x360ce.Presets.xml

    Filesize

    182B

    MD5

    f135ee37bdc2bee6bf638994e6a94f0b

    SHA1

    4760b3c9a1bc86f8b57891cedd01ba76a6552e8c

    SHA256

    5a1e6a26433d1c1d5b72ecf67ca89dba3ef9a35192b23640911bbf232c21b458

    SHA512

    94346c7cf89c39440635ce876cba9b56571f7c40372a13717b565d202258586714932a3fcafdd6bbf64b91cc4a924b686de3ab9c2f53afcd6b77e801c1f1d785

  • C:\Users\Admin\AppData\Local\Temp\Cab4952.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar4964.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\xinput_X86.tmp.dll

    Filesize

    123KB

    MD5

    5236623449893c0e1e98fc95f067fcff

    SHA1

    50b4f1e2340b7c7ad065b2111fc075b2cafe6231

    SHA256

    301f0d831d95bb5c3b5c57f8a92a35211531b410fcf2bd08927a286b867142a3

    SHA512

    9b94bddcb5e64bbf3649567f16a828588423873b60858d45c40155f36cc7f95d205f4e9b6cdc8ac2852240fdb6a67d0940c60e4f103cecbf118eae1438019c0c

  • memory/3040-58-0x0000000005010000-0x0000000005054000-memory.dmp

    Filesize

    272KB

  • memory/3040-56-0x0000000002520000-0x000000000254C000-memory.dmp

    Filesize

    176KB

  • memory/3040-0-0x00000000747FE000-0x00000000747FF000-memory.dmp

    Filesize

    4KB

  • memory/3040-59-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB

  • memory/3040-60-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB

  • memory/3040-62-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB

  • memory/3040-57-0x0000000005910000-0x000000000599E000-memory.dmp

    Filesize

    568KB

  • memory/3040-1-0x0000000000A10000-0x0000000000D24000-memory.dmp

    Filesize

    3.1MB

  • memory/3040-76-0x00000000747FE000-0x00000000747FF000-memory.dmp

    Filesize

    4KB

  • memory/3040-77-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB

  • memory/3040-78-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB