Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06-08-2024 18:20
General
-
Target
d74ce9b715d88d1d7513c94b9ffc7060N.exe
-
Size
2.7MB
-
MD5
d74ce9b715d88d1d7513c94b9ffc7060
-
SHA1
2bd610362d3dff6699f0b90837f299fd18eec699
-
SHA256
7c48155c521008071cc1a17db532853603ec2cbfb36c1a0e5d1d92a54632729a
-
SHA512
0dd1f54952143fd1e32f097ad753112ad67dd4b3be947569b19241db5d33b8c35f5e2d755900aebb1728455ecdbbd19f1301ea2077d42de93b89a9f33f6a517e
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBH9w4S+:+R0pI/IQlUoMPdmpSpD4X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d74ce9b715d88d1d7513c94b9ffc7060N.exe"C:\Users\Admin\AppData\Local\Temp\d74ce9b715d88d1d7513c94b9ffc7060N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\SysDrvZE\xoptisys.exeC:\SysDrvZE\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD54ee11b1b692484b7d574514553fc0f8f
SHA1aa01b805e4a347238b8b6805c2f35cadd4bd0eb8
SHA256c8b19cd6186d21eee4e7df9573936c4535c8288b5ea7c7f8b0e6dddf5d67d177
SHA5123433b560bc1776b7960fcce0626b937f7a16a0f5e3b5668751a18b5bbae4bcc2985a2b9426c0cb66e8294a9026785fb5ed1df406dded045902bfe0ee88ae23ad
-
Filesize
2.7MB
MD5e7ab7f9eeaf0696391ff2c72139a1063
SHA1b327100b84c428721370201ae8ea36153da69703
SHA256543d01548c559a31d7ef8fcc72e41888a5e07411897d0a3209912af8268bd889
SHA512282c694abfea4cc56f24bc1d002c8e72e9a805413e14dcc43bc28b50a11d7bd73621b577f7881b81aa5b4c99bb58052e518549edb59a2d1ee887ad8dc509e545
-
Filesize
206B
MD52b4b34964d1703e38bc17c1651349e7a
SHA1d5231c7e2739f0b683b8c54d43ba008ac87cb12f
SHA256cbe74d49e3f17c7c4c56fd48c18dbe2f260ca79d822e8884f8a5dadb8a445bc4
SHA512c058f5ffaea4f4d70264152995c04048f398a0f98788ef893b821c9af2c7c1bc729a0fedbb556cf965ab8b70fe4fcd5d262d68cf885b8b12e8772d9b62e79d4d