Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
19-08-2024 05:19
General
-
Target
303ff56449b11f635c04d89dff72e490N.exe
-
Size
2.7MB
-
MD5
303ff56449b11f635c04d89dff72e490
-
SHA1
7dc7894c577fa0dc9f74fd84ab4f13e367cc7351
-
SHA256
c82802a5f6f8abe5ae77d4361531e6577fb20e43c93cca810cd4001b7de2e480
-
SHA512
c070b6cd3917c8f0957e722c356daf17cb24ea45f1f98a901192732c69a8fe690bd4e287f1cbda83a3e1fc841639fa7cd53788c60ecebb9da93c5c9a376c867d
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBr9w4S+:+R0pI/IQlUoMPdmpSpH4X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\303ff56449b11f635c04d89dff72e490N.exe"C:\Users\Admin\AppData\Local\Temp\303ff56449b11f635c04d89dff72e490N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\FilesG6\devdobloc.exeC:\FilesG6\devdobloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5933e36efe84d567640c103d6b61f8ea3
SHA13b412b89e237e118d8a4f45a0171f33cfd016e76
SHA256cf56f6d7b50e3cb2c44df994f2054e4e6e784f5381085239fac37957ff135bab
SHA5123043aa9313b413362fada58176b1c74bdec361bd7b471653c8ce92546c09adf67b4cda463eb08872a5ce07dc99cf8059508ee4c83d26acaec3b6a9d91005995b
-
Filesize
204B
MD58a2cc69fa070a3040b3cd1a43f3575c9
SHA113c8bcc293d9caacda325a68e1648a723996f56b
SHA25604b396cc9e8081ad691e01abc2f244f64ac80c2d8a34e0aeb5b45eee3403bb15
SHA5122a600c174a2561e1f1afb9556168e3c3fa2da83fb814e28d3a9780a983edbe97643b5047f604be5ef58a79d07ec6320a5aed3054b2d8e942df9a0307a5e66968
-
Filesize
2.7MB
MD5222383d895cbe1dbc57e60ff8ae186a1
SHA1f70f938af5f588723e680dc87563ed31361257f2
SHA256f192c7906916acfeffbc34196ec887bdd7af5de4c8bf54a8f2316b2869d0028a
SHA51263f335c058e0a7e30920509d55cf254616f75408d821e1ee25905c8dd311c36f001f6415e4653cf3aeee4a1f186a78bb06d2a2cba1fc49e0bf21b1ffcbba55fe