Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
19/08/2024, 00:06
General
-
Target
bf90fde3ba53fe1f953971e6a7d58700N.exe
-
Size
2.7MB
-
MD5
bf90fde3ba53fe1f953971e6a7d58700
-
SHA1
84d34cb5e4904e04f2800e8e9ba20fb53f127045
-
SHA256
0ff7f2019ea78fde002d381ebe27a507d63f18ae1f57c02c2ba4cde9a33ea543
-
SHA512
15e99b383b644c1aa2b4f6600ec4ee830b03905fe7b3843e1a78aa6556206419e0d8d2fb40d78eed73439c75f24975e80e377f8c9f127b3f966ae15263351236
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBK9w4Sx:+R0pI/IQlUoMPdmpSpw4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf90fde3ba53fe1f953971e6a7d58700N.exe"C:\Users\Admin\AppData\Local\Temp\bf90fde3ba53fe1f953971e6a7d58700N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Intelproc5Z\xbodec.exeC:\Intelproc5Z\xbodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
203B
MD5320047e6f03cacd8329f87b30320e59b
SHA1da451a0a9a1ffcd97f46502c522a5c10e5968f0f
SHA256853136c18d2d92839d576cf44ad5795f584155453e65dba19f111933e88932ff
SHA512d22996ead49c8ec917f51bbc112f44bc55c4fbd5d332623185b2ada14ea400bd3345613a1ce2f0f63ace78c57a4e28cd029818e6d849af2edb87973edf305282
-
Filesize
2.7MB
MD548871ac524c7541f10e9dbe83f6051e8
SHA1aaaa0007e855c32cbf82f4e2a1d82241537448a2
SHA2560a3ee09008f93544ec2ae7b7a8d0da4df36b01132b2cf7fb78a27120a013f63e
SHA512ce732cc27a0846077b3668bcafac4362a80c9c1a81e7077d62f0affe3069bd3cdb9101300b3d6465159469debc8aacbe7290eb8f4b8a6868f917872d98546981
-
Filesize
2.7MB
MD548b000a5f461129626e1063082629947
SHA13c68bb4678e8ec01da6b1d8a3a8de42dd319e91e
SHA25640d19396df516b71f9b4db182478d4a91ab7cde9a5dacefae94687169e0c9243
SHA51263bc9d571a66344790c3c5dbab936d4941734eff522d927ac645fd0b227003d3d0a2639aeaf16241fba63f4ee062d51e2781ef212d47b0fdc9f0777448a4f204