Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
10-08-2024 02:41
General
-
Target
c9f2d481b70bacf3fd6ca2ed34482eeb1d2172d108d84b4632287fc4d9fbe307.exe
-
Size
2.7MB
-
MD5
35782815fd8fb3368fb0d9bdc024985d
-
SHA1
35e2fad1728abd23586cc28f2ed9cd0d201d2216
-
SHA256
c9f2d481b70bacf3fd6ca2ed34482eeb1d2172d108d84b4632287fc4d9fbe307
-
SHA512
8601006c3784552c22a6b9ee7bcc46236c44887906981655b340d63521491d2d5bf997d1246d2c0102e3babaff574cf17c68c4d909479d16acf2859f4192480f
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBG9w4Sx:+R0pI/IQlUoMPdmpSp44
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9f2d481b70bacf3fd6ca2ed34482eeb1d2172d108d84b4632287fc4d9fbe307.exe"C:\Users\Admin\AppData\Local\Temp\c9f2d481b70bacf3fd6ca2ed34482eeb1d2172d108d84b4632287fc4d9fbe307.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\AdobeJM\adobloc.exeC:\AdobeJM\adobloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD5b1e7325f36abcb38d24c249015a8dd64
SHA146bf611a0002729389a5c85a31a32a75f8dce321
SHA256d9c76f6cfe4bb91b6f5532ac63ee786f44a49d025330dfd4ef6193bd7b4991a9
SHA512bd0b38b31f0cafcc93c1bb55b90609cd8491e6247048b9d1ed4b054a2c69e574df8020716e1bc1021c088f5d5bd1fd68a7090bd659a089a53043f36d6701c0e8
-
Filesize
204B
MD5edc25df5b92880596afae369e3461e0f
SHA1d9c30a9b62bea35f3af7666e1b32ae93fd643bae
SHA2568bd2b518fc13612983059afd33645f84d892b1218885c4e72e791db9e6f15e03
SHA5129902c2b451ef1be1e22e9d03d9f4e75e15a54dc314de7ae1838429224c3cb3239b512d0e1b2b2ad0c7eded0a09f0e6caf6b356a4b54cd1d40d3b73f52e1716fe
-
Filesize
2.7MB
MD5c987c885e9797628fb20059ed9041300
SHA11c741e96ad227aa42ca831da6baf40d7b5d7d9fc
SHA256d8ea73cd26211cc2a28ce7f06a1073c5a4a3edbd21514e517241b62b44c8e23f
SHA5128c9d4187503cee0260d504c9893d3ac4df08ac6301d0ac907646b3b81908d8cd8946ffc114aea8a62db18e5c6501c7cc33b217d045170c6783dad3e7228a5429