Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14/08/2024, 02:44
General
-
Target
edd3c597c9fef8c6de02ffa2c3c148614c1da6defb5b02f076b6cce0ddcecbb5.exe
-
Size
76KB
-
MD5
c030139af11b1d2a23efda92ab31dea8
-
SHA1
e58c302f141023c770d633546c4cdb7322c6fc44
-
SHA256
edd3c597c9fef8c6de02ffa2c3c148614c1da6defb5b02f076b6cce0ddcecbb5
-
SHA512
c304b3baffa0c6c987027bfc0d6d3ff1aba05b6c2f0d809146f49e78fe407f38b8ff54dca9268f49cac54be254d0aeabb5ed694a6e46a42398a024ba24c39615
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOF:RshfSWHHNvoLqNwDDGw02eQmh0HjWOF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\edd3c597c9fef8c6de02ffa2c3c148614c1da6defb5b02f076b6cce0ddcecbb5.exe"C:\Users\Admin\AppData\Local\Temp\edd3c597c9fef8c6de02ffa2c3c148614c1da6defb5b02f076b6cce0ddcecbb5.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5faf88e9cd18eec8219fb39bf4b87ae81
SHA16ba519e9140d026a015ccf60a0f02a90d1b2f759
SHA2565a4de74ac86759fbea7d4ce45545d4ad5beaf4639f142345f1a1bff9bfd3f3fb
SHA5122f2ee798811be99be8cc79b2fb30f01139b1acac2358f6c89cf5b8570e17dc28aa2d41722992f523d7718c8c0fe28525e1be7d345ba2e56219c30206dd8b5430
-
Filesize
80KB
MD58d45ed0c0e0f35d49b6d67f88e1be8b8
SHA16f983aa346d153bf9591428f60ce638d1e4fa51c
SHA256c76721b69218cf98c981d2236b02d275a713c5e90d0e6a6d709a26ecaa674571
SHA512c5461ccc1ddb5c46390b29a4f77bc59be57c646765741729ddb223d5e56e5857eee2ec441c6ff8a25d18f69fa848ea298ccf797051052e84af9db8dcafb200cf
-
Filesize
86KB
-
Filesize
86KB