Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
19/08/2024, 00:45
General
-
Target
0caec696bc6e4c3ec0e92dc74e4f09a0N.exe
-
Size
2.7MB
-
MD5
0caec696bc6e4c3ec0e92dc74e4f09a0
-
SHA1
1b168bd2025d4f1802c1d596296a75233b8549de
-
SHA256
f677631d03e431394b7da511efc412db63619e7c46d1ab14e300dd9408055320
-
SHA512
afcca9cb551274fcf893ef1b5684c1e57abbc78f4d9c8153d909f10fb1b4e74427c9c3278ceb301dac16b93b0c95e512d9ceb857219e55436ff3b366864c7774
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBZ9w4S+:+R0pI/IQlUoMPdmpSph4X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0caec696bc6e4c3ec0e92dc74e4f09a0N.exe"C:\Users\Admin\AppData\Local\Temp\0caec696bc6e4c3ec0e92dc74e4f09a0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\UserDotOR\aoptisys.exeC:\UserDotOR\aoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD540ea5854f28bc9e7b767d48567c7d684
SHA136bea5ed2779e217637be4879fda18fc4c1bc4e8
SHA256fc13ee65b7bb2af3fe14af2be3bbe8ad8501090c1bf27382409e00987957e85e
SHA51226d04ac9524013683702f6c5dd104eb5c8840056c5d6875ac97948ae9825ee7a17cd2add8fc731237f82718a344fcbad08b6d3f9cab936fa3e148d103be2fcfc
-
Filesize
207B
MD50b496e959c740f3fc6bba23154a0269e
SHA1a8e6b93965203322fbc65cb74edae59e137540b2
SHA2565aa522bf0de242d08feea74cfe834c9656fa78a2563ba18dfb4dd84ddec2abd8
SHA51260c25a924e9413716009c54b99af5eb1ba56f3adaf090d1ff3e981a4054c2f1d8a8e734fd367d68e7ef579235df95d42c5b6b850f9fa3f8b68e9d34892663ea5
-
Filesize
2.7MB
MD5599d4e236fb94784e2be643e97666e6a
SHA16658f18ca1eec53a099b20d2c2feff80bb3140de
SHA256f9e154312321e0c94848ec0a0c0aa62a55e59992b63a90979bedca9b515b9f32
SHA512180c3dc31b2523c8b0a91862aa3e50de1c8f69cc094ef5d49ff996e35e3453fb1192678ea86cc26595ed5c1764151034af9391412d18e356ed815bf2b56f6aef