Analysis
-
max time kernel
119s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-08-2024 02:17
General
-
Target
74529e9b7074aafd196fa174365bf770N.exe
-
Size
2.7MB
-
MD5
74529e9b7074aafd196fa174365bf770
-
SHA1
fb9d16ed78d63a581bfc500a5b5b19238224822a
-
SHA256
7f7fbbc262373a2d888f01275037e15da07d35561846c55250abd5e3dce4dd6b
-
SHA512
aff2d7ffa7df28b6aa0c0c0f3e4ef700c37dabab0886b70cedbe0198397f9e1465abd6b4543d737eb7658847f4c1d71c54bf56e09357850cfaf5b5173dccc272
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBZ9w4Sx:+R0pI/IQlUoMPdmpSph4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74529e9b7074aafd196fa174365bf770N.exe"C:\Users\Admin\AppData\Local\Temp\74529e9b7074aafd196fa174365bf770N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Intelproc6G\devbodec.exeC:\Intelproc6G\devbodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5ddc2693cfa302a8b02655b9e5722bb31
SHA1baac001d2ff29861b646efc8f6e8b1e76688a77b
SHA256092637e308fa4c62c5c6bf0988c548ee02b0c9e332746b502a8b6c94e0923021
SHA51276efd1dbae083d94377903cbee056ef4bee1ef3fc85f38f8295d5db0ef93f4b1987c798f2889620b184c1c687d062fbf59ef2f5cbb2ed02fc5042790b48848e3
-
Filesize
21KB
MD588c4193a34bc33ed642c08b873d8f01d
SHA109090721da01bb4de69a935354eb91e434b18f1b
SHA256885ae505ce1d9fe457313dec50b16b13a0467d754c98013814cc7e643b27ce0e
SHA512bd78e8ee2067c7a441769636d628685fd84921ccd58e82b05257dd862af095dba0fbe9642b38d161c7bad148f749c65592c682bad75a7ad362ae9514d2c6dc50
-
Filesize
211B
MD52958fb7259171f4a9472a0faca6722cb
SHA12c8d88a6e909548c3810a9f9bc1f9475e554b30a
SHA256d1af73dcee8a56007ab5812a5759709f2d09fc072fabc15f600eed99dd4cdf40
SHA5120ba5b45033501a7fd30c533b23fd082a46d03a703fbb20548c9b59c8d8201507feffe91fc2427748d0ba08abd2b293e4cf5f85a615244e183877d6311b3f8b28