28411261cb3f27081f910190d1c7742fb805185430af10131d5b39fd2e39c832

Analysis

max time kernel
131s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

emule.exe
Size

5.5MB
MD5

f3f709c2d49dd6636f4ede5c2cae5448
SHA1

8e0ea03e4c38199e10a2bc12db8b2df70484111d
SHA256

06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e
SHA512

7a0df912b5ddc149d770260a2e1a3f55e58ac2e9ef02883e8baa08e79261075b82955bc8e57641bb2c16983abcada2581850fafc11b92a133605127bda80513e
SSDEEP

49152:/BGoXbyOj8LePLHcPPLRCAnyOTxP9DzE4GEATLHYiipKXePi9Wxmw7b4ZC1VTWS3:rEWLHcPFCv745ATLHY1kO6g0w7b0XiG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emule.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\ed2k\shell\open\command	emule.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\ed2k\shell	emule.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\ed2k\shell\open	emule.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\ed2k\ = "URL: ed2k Protocol"	emule.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\ed2k	emule.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\ed2k\DefaultIcon	emule.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\ed2k\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\emule.exe\" \"%1\""	emule.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\ed2k\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\emule.exe"	emule.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\ed2k\URL Protocol	emule.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2304	emule.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2304	emule.exe
2304	emule.exe
2304	emule.exe
2304	emule.exe
2304	emule.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2304	emule.exe
2304	emule.exe
2304	emule.exe
2304	emule.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2304	emule.exe
2304	emule.exe
2304	emule.exe
2304	emule.exe

C:\Users\Admin\AppData\Local\Temp\emule.exe
"C:\Users\Admin\AppData\Local\Temp\emule.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\eMule\config\preferences.ini

Filesize
26B

MD5
ec0280f3f439c6febb6b49883c5c100e

SHA1
642fe5a3945184440c48368e92c0d6be4c195326

SHA256
f124bff0c7833f05418d9980d994152346329d8ca56d080840859aca3a78f151

SHA512
cb5e24ed70c9228eeb0028be1ed1cd69c1bc7961f203290a6fa9b0f55780167ca4d989ce09a2f654504da5bcc9e4ce79ea4f5121680a62fb65bcf929f109f5fc

Download Submit
C:\Users\Admin\AppData\Local\eMule\config\statistics.ini

Filesize
1KB

MD5
21c9c0b98bc3eba4257368410ceed74e

SHA1
5421a84d9573ca6119d3453297209042d4ed0808

SHA256
55a0050ba9a5e0abce09ddb2fe7a33fd29dc151465cd9c529068a3110f851218

SHA512
39d2f95896b6ba4ea7fd1a1ab7db617761213ec643c15baf984c1487d6ace1ccac7ff9c2c456b803b1a64dc4fc62cd6d0d420b15507838f71ffaf94004e47645

Download Submit
C:\Users\Admin\AppData\Local\eMule\config\statistics.ini

Filesize
1KB

MD5
31a34832f36ce2b28a2df4d30408248a

SHA1
14e2b22ee5e14418823b16de7a2a8a8b00026a8b

SHA256
c8ac46efd4f1d457831373acae25baa3feb2afdf9e0282c666b72edc5037182f

SHA512
3834551e8a989f43d4dcfd40698b7bc452e19ebf4848448acd96ce8a43dfba4e20a8164698e0e17507567e503e5bc89babf921ad0de3980e5590d2958bfccb12

Download Submit