Resubmissions
19-08-2024 09:37
240819-llp1nawgrg 9Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
19-08-2024 09:37
General
-
Target
_Unpack Portable.cmd
-
Size
1KB
-
MD5
8c7898906ebb31f46601033bbd774c8d
-
SHA1
aa2d0f6dfdfd95313cae05a9ecee6c778842273a
-
SHA256
5869eddebf01cad116d867b048702043fb3c32c2091322425cdbd8bad9a7ce95
-
SHA512
6ff8cfdc8a7d884fd599ce862ef13393db1ec63723be7ec8ab47fd2feed74918a5b16ce101f52b87491b804b226b50618ab0d0374c50d7e2907108432c1b3e5b
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\_Unpack Portable.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bandicam 7.1.3.2456.exe"Bandicam 7.1.3.2456.exe" /SILENT /PORTABLE=12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RPDSO.tmp\Bandicam 7.1.3.2456.tmp"C:\Users\Admin\AppData\Local\Temp\is-RPDSO.tmp\Bandicam 7.1.3.2456.tmp" /SL5="$6015C,29686179,66048,C:\Users\Admin\AppData\Local\Temp\Bandicam 7.1.3.2456.exe" /SILENT /PORTABLE=13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD586a1311d51c00b278cb7f27796ea442e
SHA1ac08ac9d08f8f5380e2a9a65f4117862aa861a19
SHA256e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
SHA512129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
-
Filesize
3.0MB
MD5b0ca93ceb050a2feff0b19e65072bbb5
SHA17ebbbbe2d2acd8fd516f824338d254a33b69f08d
SHA2560e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
SHA51237242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
912KB
MD5feb8284d9af91d2b30c6c1496d7396b6
SHA19309b3941896535c093a27606ed1aff0b58da7b9
SHA256c43118d4d3fe00df5ed43d712540698526aaa91593c1f19ce51b24edf9785098
SHA5129a821bc3c350f94621f1befb188d256c6027785ec666ca5bc83ab7ccebed64a5cfc809ba8d4d91a26c20fb08a2b4fb97f11b111b0dc1d0f89a1030e4f38068e7
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
988KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
88KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
92KB
-
Filesize
40KB