Analysis
-
max time kernel
119s -
max time network
79s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05-08-2024 17:26
General
-
Target
b71c5015b2110c1d4f3431b50f6ee110N.exe
-
Size
2.7MB
-
MD5
b71c5015b2110c1d4f3431b50f6ee110
-
SHA1
13d7d6b6200cc7026d46457fc7d184e61cdba5ee
-
SHA256
2bb565701aad28e24bbda9ab61998d3f945058f105731261707b3e2acbb49cb4
-
SHA512
d1bf950d8b161c2865a4d21e40f722218d65382188189716d24ef35d2b878bc5bc17c79b48b808c33461c597515adadb945569c27fd7de2cd86399585ef90678
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB79w4Sx:+R0pI/IQlUoMPdmpSp/4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b71c5015b2110c1d4f3431b50f6ee110N.exe"C:\Users\Admin\AppData\Local\Temp\b71c5015b2110c1d4f3431b50f6ee110N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Intelproc33\devdobsys.exeC:\Intelproc33\devdobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5125aaef47592369c6c4570fdf02b2045
SHA1769dbe2632f80522b0fdfae7a38a7eb38ce91757
SHA25682c7906254adad848cca8b805be07e97c298e4babef8cbfdc8e34bf47cf57b2d
SHA512980e59a3c546e0e3eff62adc62b074f28c9fc066eda4daf1d04c92ba5f20db9878543517c1d5a0ad60c522f1b535249fa39b1c6720e0602c2ee730d2d8214716
-
Filesize
656KB
MD5fb621e49d9fece55998b0ea514b1a5b6
SHA1d05ac8ec01d6b6c703126b03e6c63f60663dbcd5
SHA25629b7d5268db68e2931d3842b9b6a29d4fedfb308351b7b684677363231f34429
SHA51256011364c2735377c4be01066ba4bb9f1d547b29399b45a29a82db8fa19d2d71ab7be382eb3275dcdcbc5e7800ea021f79eaf8f6a138c0bd4b7d336043ffcfe4
-
Filesize
208B
MD5f09139ce4b884fe4340e9cc6687187a0
SHA162917baaf4062079e8a6ab1029744a03c11011df
SHA2568e47ee102c31ed65daad1eb2008e8810abbafadfffd8bec3543f6d5d571270ad
SHA512d8987b3a7bd61e0b9339b220c288a513f6ba0884d901981a7cf4dace5bbd56ea0784098f0ddad43f01bc1ef945cfe79a9ef9fdb678f4a2f87a852bf4e2aeac53