Analysis
-
max time kernel
119s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05-08-2024 08:31
General
-
Target
6e3726a08f8a50fc7c6bad94a5bb4250N.exe
-
Size
2.7MB
-
MD5
6e3726a08f8a50fc7c6bad94a5bb4250
-
SHA1
ba17f93ab2e29687a084f310aab6c42837bb9d09
-
SHA256
54a6cbf15a4543a12d3f5746dd5ccd8a1ce8f1bf45b9fbd20cd5322cbce19a95
-
SHA512
a562c0273cb4c98ae1de6fd91c541bb2539c6e158db8cc56f3b73cbf6a4b7e8bc1d87640cd120f9fbf04fc18c7ea0e1a9b601d927a30981432ff2f7366f0072e
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBi9w4Sx:+R0pI/IQlUoMPdmpSpE4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NTFS ADS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e3726a08f8a50fc7c6bad94a5bb4250N.exe"C:\Users\Admin\AppData\Local\Temp\6e3726a08f8a50fc7c6bad94a5bb4250N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Adobe3R\devdobloc.exeC:\Adobe3R\devdobloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5a7f921c38deadecc5a64204bdf7ef968
SHA1734522d3f9347614e2353a59dc3b323a92283903
SHA256b4caaf1b36e7f7f831a81cb6c2dacf7fcecd82c3eea7ee26db03bd2125fd6cff
SHA5125fcbdd5999d124bdae79f461319747b970f03f0d2b57a189f2882821833e59fd06367a1518c20838702f55701c385fb59e3cb4ad9e0b8211471e87b1357152f0
-
Filesize
247KB
MD54aeb60634ea956f3f13fe11b0d730717
SHA13e1d39e5735f826b31cad773b0af6848ca6a0949
SHA256266cb33c34c349cae624a6bbb62356321acf21e258a47ea183cdb76458ea0293
SHA512e38d2ec23207179f033360b971dfc6b674b557c3c2b3039b266de150ca7e107a7be68d23dcfcbaa84181c6ae6094f01df3d37c6cb1bdadf770d5429334db8153
-
Filesize
204B
MD5baf0cb5190e0a578f30d25f8e499704d
SHA1fdb7a21ae160d0592a9de345afb76b85b913ba69
SHA25666f34c1d33b87e4d15b44082664e21dc8c3c22c56824a248bd6c8e08bfdd4838
SHA512165d61994dee0f4c0fcdef23fae95a941ceabb982b244a821bbd32c52e28655976c97044820cbad3aeb52c4829ba5281ce0b072c52bbdf7fd9c5c99b1e8581b0