Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
14/08/2024, 02:59
General
-
Target
d5875c87286f358cd463091090948650N.exe
-
Size
3.1MB
-
MD5
d5875c87286f358cd463091090948650
-
SHA1
cfea58e54aa35728339276814702fa911389a81f
-
SHA256
093894241d9054c09a50e9518c7994e48ae52fe30b4f7f2eb66dac0b3ad0d6ee
-
SHA512
18dd7817cbf4b2e8393df7cc4c2805af6b5d8b6403e7b25da8136935a773f3c578e2e4efe1686fc7e285aa1796d25a662ca536f7835d9a6fc00f4f396b4540d6
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBE9w4Su+LNfej:+R0pI/IQlUoMPdmpSpm4JkNfej
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5875c87286f358cd463091090948650N.exe"C:\Users\Admin\AppData\Local\Temp\d5875c87286f358cd463091090948650N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\SysDrvIP\adobec.exeC:\SysDrvIP\adobec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD57a31e28a3c7909f3ee0ce7009d059ab9
SHA12914181d62005364d5f709e29bdf4493c7cb8306
SHA256e1f3f6675cbf55119ef1af9ed393fb0db06a7757149281cbfff7d305d99efaed
SHA512653760f6b55ae3c6aaaf77138f38da88f095df009939b31aee90f29c84babf558c1bf4d3a5dd5d4abd4dd20f9b28d713c7811a6b738c8f91892610247f0d7a0b
-
Filesize
203B
MD5bf3ba4c253bbb1314e77e86542802dfa
SHA108dd46b73f2f7db010e3e12308c2cdb6d64bccf2
SHA256a0df3063f80dd154cad7600f7ecd0ccac0fabea897e0217f752bd57983113750
SHA5122f22168c155d2a4dcf573ecb67a442becb240ee6afaa057143809fdee221614ae5fbf8cb25e46021cd871226d0798b99b4e511ea6741be400ab0220de829cff6
-
Filesize
3.1MB
MD58a10f8486467bc67761d18d37029eba3
SHA1170c25881aea000b523bfe49dc0540e6f9869024
SHA256fe6ea5d3677962d7f5a1097c856d943de780a4f60126037f5f1cf273f1068340
SHA512c65339ef4866599016de654dc9ae51d508dad80e1a8e2024be27c213037b3903d04fa85f41639161107014cf11fa8e28ad0d9a195ec31a576f682e7e07bcf56a