Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
06/08/2024, 14:34
General
-
Target
bc4a1fd52f80a991a11f4de20965b3c0N.exe
-
Size
2.7MB
-
MD5
bc4a1fd52f80a991a11f4de20965b3c0
-
SHA1
ccf8aa92604251e69508f2b695aa6f266554057b
-
SHA256
d79e6d48d7210241b9ba1d9593bfc15dcc03d14332b7f25b18d2b0f52e8957df
-
SHA512
dcbab80e8f9d17799fdf74918321fca4949a3a8fbdeb144eebfce210be90a97c185782500934d6dc1a2408f84b10e1021b79bd0295b760c4f39b3b2f3d69e095
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB99w4S+:+R0pI/IQlUoMPdmpSp54X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc4a1fd52f80a991a11f4de20965b3c0N.exe"C:\Users\Admin\AppData\Local\Temp\bc4a1fd52f80a991a11f4de20965b3c0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\FilesUS\devoptiec.exeC:\FilesUS\devoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD53d5c08e3984922a4243d9aaa8151fa8d
SHA125bee68de29c1ee217ad117a7887f90b3615936e
SHA256dbbe10d66b8d19cd2de465e0762926a6c4b8c210b43f86c6f408287ea26bbf6b
SHA51295ddf7346c74d9f0be13d8e98948184ad74f95aaceb79ad727db15b4c9731d08809a65d85b113500d1b71998997177f13e52061b9e87ce9765e2b65f7dd6e7bf
-
Filesize
202B
MD52a808355e30c54c787c45fa2ac4c6a3f
SHA17de348419b3c560c476ee9f5253de6687ff66e4b
SHA2569fcd0e5fe9be1c8c7a0529ea834a1f7feae55795cf027a7f10d24eab7dae574f
SHA51284cf9eb21873c26b19f2d166becdd2a7bf51ea8f502f2225f096b5465beb4227a30744d5c283995e051033d345f7579106f15514b8a0ffcb51ea8ef458dad4db
-
Filesize
2.7MB
MD5b0254e9c9276acf0a654b28146ea40bd
SHA1508b335bb1816809906cddd1e5b97d8853eed8ab
SHA256c2f2e268f40fc2211c1374aaedd4ce48a1762f0ad09c92cc57215ee6da235984
SHA5121d142a2a95a449f2efe92da393392304951afb6c23d46405662f97aa0156a8f2a302360b7d774083c82e246b7477b5511091b21c46c739fa18a825e006a67b39