Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17/08/2024, 00:16
General
-
Target
6ca6287e865ef445cfb93e7f2cdb2dbbd06909a5ad027884ef4540a9ab811efa.exe
-
Size
2.7MB
-
MD5
bb0f185838cb005467c702d14c9a7694
-
SHA1
7a184a5899845aca5e387268d35eedafa752d5ef
-
SHA256
6ca6287e865ef445cfb93e7f2cdb2dbbd06909a5ad027884ef4540a9ab811efa
-
SHA512
33885f317b3593838650701a0ab702ac5c9426077d60482c3a21ef99437d93b32a3c905ab42e4a358e0b66e02ce5d4d9696bf1def4ba51cbec659bdc630b3125
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBK9w4Sx:+R0pI/IQlUoMPdmpSp84
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ca6287e865ef445cfb93e7f2cdb2dbbd06909a5ad027884ef4540a9ab811efa.exe"C:\Users\Admin\AppData\Local\Temp\6ca6287e865ef445cfb93e7f2cdb2dbbd06909a5ad027884ef4540a9ab811efa.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Files6X\devoptisys.exeC:\Files6X\devoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD556935158529b9a0d532107de76c07198
SHA131a744461017977ec15bf7a11459ccea92083e53
SHA2565ff88c136f1e2a300946057126c73d5e6faf79e7c5eb4238f5881b08b173c0d9
SHA512473312691b1a8507bea887ffed9816875bc8f3eb308f6148baaaf915cea7d4da302b9ceb9296747da7123a7f3eb016dbab814076825bf998d14f47019adc13f7
-
Filesize
2.7MB
MD5ec179e841ad9d289096619d2b5d4281d
SHA1a74d638e68a24a3e1faa17f00961cf08a3aea356
SHA25653f5ead2640404258eadb218b5a54b0bf09c97e7d3112f1d1d1cb2e1c779684a
SHA512132bd7a5370e6e6dee1038513e9bb2f0e6aa15bc5baabea645708e197626c9f1379c3e2bb565a9c6f414df8044f7c69f87d80c77de7221b44e914d556ad121a9
-
Filesize
205B
MD5bef5e45ea93a48b9800e074585f43e94
SHA1fcb7fdba29adc81b2f191d01e3d7fd212ed54781
SHA256c6a124a795cb7429371ee54150dc4253ec713901847108087f06bed2e6016cf4
SHA5129c4511473003dc77e46588cf033b56f2196daa8580e332d785d80a9f735941462746f5d8652ce7a057b711f2d912beda5d41f8376185e331d81f7435551f11f7