Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11-08-2024 01:53
General
-
Target
bec8bda418f414925e9e6f472ea923fbc4cf96a4529a5700e9e2fd49b13bf964.exe
-
Size
2.7MB
-
MD5
26fcca53b499ac68c5d5375504c7733e
-
SHA1
15ee8e7856ef24579f468e873c0eda0f1fb9e1d5
-
SHA256
bec8bda418f414925e9e6f472ea923fbc4cf96a4529a5700e9e2fd49b13bf964
-
SHA512
170df37d08d43a78ddfa5fbf829f5f7f5ec2be165f329c71b11d76b84d92489d47907a2361d2d569ebaed13df6672dbcd9dad33b0784278f23839777d8da9727
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBe9w4Sx:+R0pI/IQlUoMPdmpSpo4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bec8bda418f414925e9e6f472ea923fbc4cf96a4529a5700e9e2fd49b13bf964.exe"C:\Users\Admin\AppData\Local\Temp\bec8bda418f414925e9e6f472ea923fbc4cf96a4529a5700e9e2fd49b13bf964.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\UserDotGV\xdobsys.exeC:\UserDotGV\xdobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c7b51062c87a208f9442963c2b20d250
SHA10e547612586c272a27827db5dbbed56d37a255e7
SHA256e3b4eadabd908d54c7c9252808b2cf750431927782a3b7b3e596467be1bde3e0
SHA512fa80cfdd204d057f6913115178e8c1aa005c35300a166dbe3f278d747a2bd73b6ffc6df2602db45993d1fb681a48db8e6b9a5567228ee5007c7d933035c55e9c
-
Filesize
2.7MB
MD5fbaedf96a65d11fbf4bfd2773a063f8a
SHA1e131c8187d6d9812770b071f8d57c667800d3379
SHA2567d9397dcdc9bbc6c9d0ab13ded9081d06787e12824e22a334f5057af4507c65c
SHA512886da6080537faffb55172a2af08db20ba81d72c3fe705405c9c9057c45331e28f5d20363cab5d8bfcbe4da5df5f3f2c39e888105ccc2d9cb6b4f10cde842c86
-
Filesize
204B
MD5ad3a035a9d476dbd6bb96b151ec2104c
SHA17ff0dd177abe5a7343854baf68fc9fe71ce13d81
SHA256ee321fc59cc6baec27eea8499a17fd7e942621ac356a8ff9c86c494e9a322aac
SHA5129e92c9e52f0b1daa77f1603391bd9fa61648c9c9818aa1da09acfae041b0b40ae6234cf90d409b7cc72fc6c12f8c1a68d8fb4cc5b8edba628e43c295f1db9f80