Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
19-08-2024 07:32
General
-
Target
c6d5175e9851b9c21573bdba3c523c90N.exe
-
Size
2.7MB
-
MD5
c6d5175e9851b9c21573bdba3c523c90
-
SHA1
c6fb062170aa6c9e2d4d26b60bc99a54983e8bb7
-
SHA256
719407fdc3e26b604f02379c64a163c8cdae6337ce512d7d78222660e9c7ff4f
-
SHA512
454af2917ed2affd6f395f38a767c5dab56618ae0bd48b5537d8634d3459a85a839530bf1b220e8721278861d5bdbe83d4538ca81a20976e313ee8f6076749ef
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBY9w4Sx:+R0pI/IQlUoMPdmpSpm4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6d5175e9851b9c21573bdba3c523c90N.exe"C:\Users\Admin\AppData\Local\Temp\c6d5175e9851b9c21573bdba3c523c90N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\SysDrvM2\xoptisys.exeC:\SysDrvM2\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD522fcf96899861d0d7064ea98eb7d9852
SHA19c901041232574bd249bad6db3e2f2ea02ff6552
SHA256d5041934083edc2979c517d1ec94e709398b2ebfb33f1726bd77904e044b3eba
SHA512498c880e39a270726b4b36c7e0bb611d7bd8768dab017c612a662423d5afd6792d0dd08a361887a0527c337c8ffc382e0358bb8f4c60fb3b802159efc403fab8
-
Filesize
201B
MD55f39d96e4acc1f6afbfd561add21fc9b
SHA182d6f2ed66f7c4937b5fa7d6d72c296395ab9c28
SHA25652a267e936f7bc7cc6d28c96ea7f4c53856dafaebcc5179ebb6fa82924b3d3b3
SHA512e8c02c82747ab188d93782473a2f5b83c13fdb199a84f5864025a00a63bdd2bac8a594e911d6f8d93a3a448f0ca6f7aea54485bbb3439545585b9c6b8c171992
-
Filesize
2.7MB
MD526f6b9bfde72838953480cc2fb76f3ac
SHA10f55b62123d36149e8678aa5ba4a856e4034c2c7
SHA25677685d1d493f66308344df71c02529f658b5eb1cbd1c8d24ed1922ca143a985b
SHA51228471c7c1bfc87f1866f90c47db8d9e7617075fdf69a72fec9306961a2fec055ddcf7b68712b6c56aa33048c8dfd4e79a8c9f2fe254758ad0c85c22674169bbd