Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
11/08/2024, 04:35
General
-
Target
fc9c824158f8e37e90b66d2597d52fd02ddd9fb8eb4d7d2b74f2be63baaa107e.exe
-
Size
2.7MB
-
MD5
4b823a24aa0a70d4c28412b7f7570f74
-
SHA1
a4da6e011db1e23bfed54769c4e8e4658b2ae415
-
SHA256
fc9c824158f8e37e90b66d2597d52fd02ddd9fb8eb4d7d2b74f2be63baaa107e
-
SHA512
6ba1eeeddca9166444f9c646442115933e03581353d1e27c8e2c745c82126230b1fa7c214d70dddbbe05435aadd039f1787c29319c03806cd4fd3f3c554f5a94
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB/9w4Sx:+R0pI/IQlUoMPdmpSpT4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc9c824158f8e37e90b66d2597d52fd02ddd9fb8eb4d7d2b74f2be63baaa107e.exe"C:\Users\Admin\AppData\Local\Temp\fc9c824158f8e37e90b66d2597d52fd02ddd9fb8eb4d7d2b74f2be63baaa107e.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Files1V\aoptiloc.exeC:\Files1V\aoptiloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5bf548526b9c4ca3083874caf156b2195
SHA10a71a992f7b959da1ed6f1ff516742f9ee5622b4
SHA256285be0f8204b248e819f62850e4fb69142b2fb62d2e5656296edf182173f33b7
SHA512cad78dccfcdb1aafa35b1144540c8fdfd893d7fc7c1911e9c1cd82f1132ed9aae5d06a9aff6d5f6631a3949a4e92e50bce1742989e7acb0e9ecf343bcf3e7b77
-
Filesize
200B
MD57038ffaeca99001ffe1a05efee606e48
SHA198fa95bd29e87f2b42948922a37e6d687a22692c
SHA2563a9621127820eba9f039cf1c2c3c8b45a13ee02bc36c1c3e3815e1eb72ea029b
SHA51260956335218f20120d721483e9481c80eb000ed185f9b6830ca97bf060a0407765336a68584e4bff46cf00b01668c55e6c2c0a173e9dc3f06a0d7598a4cb0fbf
-
Filesize
2.7MB
MD5ec4eb6fa9e93f656d300c3f65f54f2a3
SHA18752858a2a634b50711858f9562d6afd658f016b
SHA256a78dfb1a4ace8ca37d4dfe48b402df2b6aaafc53fe90cf6705741c051c8f6ca6
SHA512959927f81f18ae6b4c7bea83a7a459c6cdc56fa39ba31471d37cb440a9b6160c720937f30da896eb02a15a01a57395db7d990fa214f3c74f74d76c5129fabc1b