Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02-08-2024 23:59

General

  • Target

    8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366.exe

  • Size

    1.2MB

  • MD5

    3dc8ca829ea4639a0d78f05ae481eec0

  • SHA1

    02bf8b9d26be7be2727bf980b5eb1e5e1c29bd0d

  • SHA256

    8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366

  • SHA512

    5162ee7aaaeabaf66280621bb239f47d3f8e66bc5fa9fee06083c60b9a7f5c27aa66b08dedca083e0e913ca8a9145e951c495fa327c31f822977243b46de8732

  • SSDEEP

    24576:KSY88f02Q1HCEWN2ZIOlWZelqxKR8MdjGUZWXABvz5nhj6Mcg8:z88FCEHwxKliUZvBvphtP

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366.exe
    "C:\Users\Admin\AppData\Local\Temp\8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Users\Admin\AppData\Local\Temp\8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366.exe
      C:\Users\Admin\AppData\Local\Temp\8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366.exe
      2⤵
        PID:2716

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\D1.dll

      Filesize

      23KB

      MD5

      63fc996c75f5560acbe0a28dfee18f07

      SHA1

      f07317e054060d5bc41b9c583ead723288e2cdd4

      SHA256

      b1409c400b05819d175022c10ce322d20658cff102d5b78900d4cd2fc20a7dc9

      SHA512

      dffe944844fccfa7fadf91326fc931b7536d25f1ce205cd9cafad0319402a2c79dbce96003f441433991eae3685d71cded6ed27a24e21d58463c009461fb5f7e

    • \Users\Admin\AppData\Local\Temp\D2.dll

      Filesize

      21KB

      MD5

      2f52e1cc7eb9a7380dbf0d4ec24663bd

      SHA1

      7cd8cf6e15a87fa70a0065d4fa2e7cccd62bb85f

      SHA256

      a62407aaa2d649a6bace93fa802408977844c6a4264df5d1713842b5fb98f386

      SHA512

      8d5450f1ad0c237fc9ea076ecca1ea9667c9f560d6a264349320461ff4f35efaa64a0541167e3f8ad1a13f4f4ef453ec72b5e4d013b7a783a3fabbe1a4426002

    • \Users\Admin\AppData\Local\Temp\D3.dll

      Filesize

      22KB

      MD5

      91e37a28b4ab1e638bd54084a298dad5

      SHA1

      6c3c1d79bb96585738108fafe3d7605183cb5dd9

      SHA256

      0fe99fd185be2fdd7c8d26c972cda38fe14f39a6d4530951ce56fd743c64095e

      SHA512

      ab3609b69dd33f4bf13aaac5f8ef0dbe9f5001884f068ff5c14ff1c2b529b460ba56bea35e901e16fb1eb133c25c42d9a0ac8db0c542ea4dd450449730efe5b2

    • memory/3032-0-0x0000000074C21000-0x0000000074C22000-memory.dmp

      Filesize

      4KB

    • memory/3032-1-0x0000000074C20000-0x00000000751CB000-memory.dmp

      Filesize

      5.7MB

    • memory/3032-2-0x0000000074C20000-0x00000000751CB000-memory.dmp

      Filesize

      5.7MB

    • memory/3032-27-0x0000000074C20000-0x00000000751CB000-memory.dmp

      Filesize

      5.7MB