Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
06-08-2024 18:20
General
-
Target
d74ce9b715d88d1d7513c94b9ffc7060N.exe
-
Size
2.7MB
-
MD5
d74ce9b715d88d1d7513c94b9ffc7060
-
SHA1
2bd610362d3dff6699f0b90837f299fd18eec699
-
SHA256
7c48155c521008071cc1a17db532853603ec2cbfb36c1a0e5d1d92a54632729a
-
SHA512
0dd1f54952143fd1e32f097ad753112ad67dd4b3be947569b19241db5d33b8c35f5e2d755900aebb1728455ecdbbd19f1301ea2077d42de93b89a9f33f6a517e
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBH9w4S+:+R0pI/IQlUoMPdmpSpD4X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d74ce9b715d88d1d7513c94b9ffc7060N.exe"C:\Users\Admin\AppData\Local\Temp\d74ce9b715d88d1d7513c94b9ffc7060N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\SysDrv12\aoptiec.exeC:\SysDrv12\aoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD53d5dee51c377b97ddaec7019013553d0
SHA14dc2a706dec3676f7071aadd85cafb956b1a7485
SHA2564e0122db99842eace033f74dc5280f897d74ea1742f94e4a5fe349b97e9e3a4d
SHA512024874fa863a3944bd00ab309f13c8c00fa7a8122ef9b7aadb26a38f1626a418b1e11cdc5a92087ae20326399de48f51640bcb0d402b9368e409ea1cd4e3b552
-
Filesize
203B
MD5ca6ad0b0138c2054c53ad826598cfedd
SHA1f2fe496c7fa2d3a7348b27c9e995dd34c093959f
SHA25695bd6301d964d794c566101c9169c431139aacb8c6b6abff1305a5eaf7f8dfe6
SHA512d7ee2db171539f5b00520aa3db26e7e674e786dc5c39f8a4aecef17d60e6f35911e947ff0ace8d141d57225225cbba2a185a74084f4b59229f97c8018493df24
-
Filesize
2.7MB
MD5f9dcf02e0f3487647b810ddd352a2a84
SHA130856852005892f70648114a44a7a5a736622cb2
SHA256e3369001c8d5535d19f44101f152d882fc010f50dd8568c5e515455543c3b507
SHA5125f1027f8de4b6b0bc72eba654515cd5e93e6ccb6b6081b8b9464c6b4378b8720b36267b7b840e9ef4eead89969b1d6dcc729ef3991d04a76375c9583dc766f57