Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06-08-2024 18:14
General
-
Target
d6b4d656a00fd7aae69fb558bb5dba30N.exe
-
Size
80KB
-
MD5
d6b4d656a00fd7aae69fb558bb5dba30
-
SHA1
587b128fa375a51082e249dd8ab6d7a64c59eecd
-
SHA256
ba4e9f1436254a4e3ee987d63fff0d137dc939d8575f1d5a2f7be7d8d3d86258
-
SHA512
35434db98d31164b4fdc7867798d75e4ca4b2546ede0b06350d65ab07c82f7290691889644d3cdb5c35114467a349378ff4a81bfa6f856d1e068618ecdb964f9
-
SSDEEP
768:eLxqBt1sJw5pVNUP1/kvtbWcpmCKXTak3QIXjLZJ2bXfqQKMq+gjTAfu/MB8QKp2:Bteq0QIXJJyXEv/MBK67lALNtnd1PBwN
Malware Config
Signatures
-
Windows security bypass 2 TTPs 4 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 4 IoCs
-
Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
remove IFEO.
-
Drops file in System32 directory 9 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6b4d656a00fd7aae69fb558bb5dba30N.exe"C:\Users\Admin\AppData\Local\Temp\d6b4d656a00fd7aae69fb558bb5dba30N.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\umtuxean-ecixú±¬±"C:\Windows\system32\umtuxean-ecixú±¬±"2⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Indicator Removal: Clear Persistence
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\umtuxean-ecixú±¬±ùù¿çç¤3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5a094b29525b8337fadc3dbe713273108
SHA13c369e5e84fbd48e599ac72de8a8de16db9f2ad3
SHA2563b23e7bb1b9dbe58a91c81770415c0309ddf4192ccafb4a0f149dfcc3abc8c80
SHA512e1af413962169deed9bff8fd8bcaa84ccc51b0111c693c2f0ec02f9e0150ae38bd38b709e210a2636bb74b27fbc7a1172223025c304d6383683a0a44a738d9e7
-
Filesize
5KB
MD548c45e05569f9a5665d082fbdc116c14
SHA1e491ab1327b88312fc6d0535621b6de733c8efb5
SHA2567e916f847bb5de3e09b36bd527e09ed656df13296bdcd9924185bcccde7dbe4c
SHA512e1cc47e185831dc6c40372efc227f299964f262c641b790d31f0fe452a5bc70a4946c689913504c64790833c131d40c01fcd9ff3a148636be9f502959f7cc49c
-
Filesize
80KB
MD5d6b4d656a00fd7aae69fb558bb5dba30
SHA1587b128fa375a51082e249dd8ab6d7a64c59eecd
SHA256ba4e9f1436254a4e3ee987d63fff0d137dc939d8575f1d5a2f7be7d8d3d86258
SHA51235434db98d31164b4fdc7867798d75e4ca4b2546ede0b06350d65ab07c82f7290691889644d3cdb5c35114467a349378ff4a81bfa6f856d1e068618ecdb964f9
-
Filesize
83KB
MD526b2f6ad9f90f99835f3ebd8ab908a7b
SHA1643f2a7566a21130c89bff0b292d515fd93b5870
SHA256d3b7b7f272184d088bde258089d38ac5f6e3b9ab1f3fe53a6087266c9ad9d1ef
SHA512c3b07f7b8a11a8d2dab1ffcbacb4fcef58d3fe8e13e2fe029a89645f82ab3332cffd87b23fd70c7f7fec8fc8bd02c350b159223e7daae3ca02521a5334fd6870
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB