Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
19-08-2024 13:51
General
-
Target
0378df68dd68368b9cdad8842c255da0N.exe
-
Size
2.7MB
-
MD5
0378df68dd68368b9cdad8842c255da0
-
SHA1
0c9f7ffe21de09049536ab62e9f8b542943fdceb
-
SHA256
adf0bac30ebdb342b217ab4486e65a1b8b46915664f7dec51b73c18b5df04a23
-
SHA512
69be29e0bf3c961f7eb320e40c0d8e79f6bcf288b21b69cf0830bc0fc299bb99402e5cedbb726064887168615fc93280262085e1b461a7deb5bb6235a84ec4b7
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBG9w4S+:+R0pI/IQlUoMPdmpSp44X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0378df68dd68368b9cdad8842c255da0N.exe"C:\Users\Admin\AppData\Local\Temp\0378df68dd68368b9cdad8842c255da0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Intelproc0W\aoptiec.exeC:\Intelproc0W\aoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204B
MD51b82d9cf23c2d6a5cca7662ed3168815
SHA101b04b002e528b72b8d5ff496cca509947a14b08
SHA2561cf35582006c699db9660bdfb35e17474a4d32a768771b3f9d4ebd3ea79a3d99
SHA51297b4b9ebc4adcf7763c64acb1b0d70c0292eef8debc0c30f326f3af29aa846baf8e8b8d60d9d6bf127203d10e01b9fee774946d20a76b627cab80eeede9a5174
-
Filesize
2.7MB
MD5dcc6c479140420fbba734945cea4ad21
SHA1ea96320a88d810b3d4a5421a58802916efb1f3ed
SHA25616a9286f07803a42677b193786a8ae42180f2e8d0b01ae4fa2702a26c0949cfb
SHA51243f157b193522dfcabc4d306c447793bee188fa7fa3cd8251edb4720480515453bce785210d7bfa9f8d1f8e9ace1852f71af5914e22db46af828e61c127af896
-
Filesize
2.7MB
MD5402b45abe831bd48754cacf0ec3ef953
SHA1c4467d6eec31304842d3aee10bd6b40b6c49baa9
SHA2563ddeb933b2e86a68bd13b909e0bafa68375c93f48ba5a2471eabd0911fed9c95
SHA51287e36396fce966a1f11af7ffb7b23167ea1d2b1ee68b0e2c2d679ede726b5914d024354679bef08d20578760c1f94e0f37b0bd1412e1e2601f27f08a9efe043d