Analysis
-
max time kernel
119s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-08-2024 17:03
Behavioral task
behavioral1
Sample
1354186e143a51a4da9f43ad14e9dcb0N.exe
Resource
win7-20240705-en
General
-
Target
1354186e143a51a4da9f43ad14e9dcb0N.exe
-
Size
373KB
-
MD5
1354186e143a51a4da9f43ad14e9dcb0
-
SHA1
d400f5ec09eb89008259e058a85913369e1c3b6d
-
SHA256
acb1d23a5d8d9090c92541626236b03e3051ccb6a76a7b49d5004cbea36c0945
-
SHA512
5f63ac86614a379dce4b620db010da4eef1e9fafc4e031cc789e8e793ed6119f302e96706a6b28d32c400c61060f0352a0417c197f60d207f138e7aa82d930e9
-
SSDEEP
6144:iTnjnvrDiMNb1LSlZCgb5Oh5ciQGKAabe9RMJGtk84puHewVD/JqgtBV+UdvrEFv:iHn3dtYb5Oh5ci1+kRMbDpQewVzXtBj8
Malware Config
Signatures
-
Detects Floxif payload 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023463-2.dat floxif -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0009000000023463-2.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe -
resource yara_rule behavioral2/memory/2516-0-0x0000000000400000-0x00000000004B0000-memory.dmp upx behavioral2/files/0x0009000000023463-2.dat upx behavioral2/memory/2516-5-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2516-15-0x0000000000400000-0x00000000004B0000-memory.dmp upx behavioral2/memory/2516-17-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2516-28-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2516-32-0x0000000000400000-0x00000000004B0000-memory.dmp upx behavioral2/memory/2516-33-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2516-39-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2516-38-0x0000000000400000-0x00000000004B0000-memory.dmp upx behavioral2/memory/2516-40-0x0000000000400000-0x00000000004B0000-memory.dmp upx behavioral2/memory/2516-41-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2516-42-0x0000000000400000-0x00000000004B0000-memory.dmp upx behavioral2/memory/2516-44-0x0000000000400000-0x00000000004B0000-memory.dmp upx behavioral2/memory/2516-46-0x0000000000400000-0x00000000004B0000-memory.dmp upx behavioral2/memory/2516-48-0x0000000000400000-0x00000000004B0000-memory.dmp upx behavioral2/memory/2516-51-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2516-50-0x0000000000400000-0x00000000004B0000-memory.dmp upx behavioral2/memory/2516-52-0x0000000000400000-0x00000000004B0000-memory.dmp upx -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 1354186e143a51a4da9f43ad14e9dcb0N.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 1354186e143a51a4da9f43ad14e9dcb0N.exe File created \??\c:\program files\common files\system\symsrv.dll.000 1354186e143a51a4da9f43ad14e9dcb0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1354186e143a51a4da9f43ad14e9dcb0N.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe 2516 1354186e143a51a4da9f43ad14e9dcb0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1354186e143a51a4da9f43ad14e9dcb0N.exe"C:\Users\Admin\AppData\Local\Temp\1354186e143a51a4da9f43ad14e9dcb0N.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0