Analysis
-
max time kernel
119s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-08-2024 04:07
General
-
Target
6a129fff61c52a1e98de3db21daa75b0N.exe
-
Size
2.7MB
-
MD5
6a129fff61c52a1e98de3db21daa75b0
-
SHA1
3a191b45c786691c7e8d5b6c98f3d296a9502b4d
-
SHA256
59a88fb3571c7839d37bc090322ee9d6003355d45fa881fa7b722ce233b514a7
-
SHA512
008ddc15119315b21bd2f9eb04fb8bd53c116f97d0c668c567557022b79dc2bc8122a30482683af444b51037f6317dd677a81e2ea72b600f08e9c7da70b1a01d
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBb9w4S+:+R0pI/IQlUoMPdmpSp74X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a129fff61c52a1e98de3db21daa75b0N.exe"C:\Users\Admin\AppData\Local\Temp\6a129fff61c52a1e98de3db21daa75b0N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\SysDrv8K\devoptisys.exeC:\SysDrv8K\devoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5b92414c672ba9e2925b6757c19791fc3
SHA1a11b84b2fca34660c4b4d3eef04dbc31b34f40b6
SHA2566d936842e9500ac54f463f0aa28fe02f76bc48a010a4ba7fd4b6882d2b5e599b
SHA512518fb89373465fc5d3855acf15cf212b475a8da5649ccc0b520528f04fedc0294ad911407201f8e00807879a5c14098a17c34e837296d7662ac2b7861814bf4b
-
Filesize
2.7MB
MD51a1a8fc0d43dba593b5e3b4e4949bc65
SHA17975480ee0b6854a92c3a9cdc4503a40e61bbdf7
SHA2561006bd39f77b7ced04fa735c02bf41f1c64f2b0e7b14ef1aa085d0aa94d2c57f
SHA512e48e6be3d8ccc7a7a74316a9eb017a2d7d44bfca4b14e9d629cd82f1a051d31e43c819ee8c19fd63765d903a1004deb45dd924a0b2c208f95d563eabdcd60884
-
Filesize
212B
MD5fc73c2bc61381e6a3105feb6b2d4fc00
SHA11c4db9ad460c6a107eae82d6b2c118705688a078
SHA256d8c096bc603545d926e904ce85e8a724491baabc1481d65c96a07096b42db657
SHA51254f434d2abd33155e9830642b63de6deb5b290b6d4ddf08957a8689f8dbec81ff9f8cd2cf78b5ec1a3b8b4fe2bf07aa11c1385305d9e845522268858463877bb