Analysis
-
max time kernel
119s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/08/2024, 10:03
General
-
Target
af89226bdf1edff747196fe8aab4eef0N.exe
-
Size
2.7MB
-
MD5
af89226bdf1edff747196fe8aab4eef0
-
SHA1
5bea1fc061f4a3d6703ebbacc1b2619e0dd8bc77
-
SHA256
3caac343f90a0b15048847dd1a04b09b1d6b9d2b1a57764fe63c4aa433fd5698
-
SHA512
7ca724a17672b7e1403ee0385b08a6cffe0627c21b61fff2d3d53eba36e6f661e8c3cddbe917afe7a702d0f6ab1a6982f4d91c1acaa8b0f26210d49c51149ffb
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBK9w4Sx:+R0pI/IQlUoMPdmpSpo4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\af89226bdf1edff747196fe8aab4eef0N.exe"C:\Users\Admin\AppData\Local\Temp\af89226bdf1edff747196fe8aab4eef0N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\SysDrv92\xoptiloc.exeC:\SysDrv92\xoptiloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5a2be5cc4a167160c84661948ac3f8acf
SHA196af708b7e2e23ea0085ee30982f84fe4dd68275
SHA25605591a98fb329acda712404e4cfd5b0b727deb855b6fb58f7695ccaf16ebe9ab
SHA5127e7309644be589897c7304f07be0d8c90cbac1fcc4ef1f6bc986a3ad04412ac406a66e7d73fc77a04d75518288a2a2c639f07e35e38589c8cee733b0964211f5
-
Filesize
204B
MD5f68c8f1ee5f291dec4ec3e6d82cc83a6
SHA143d160c648cd40551101c5e00bcde94640b7f928
SHA25649e59036bc128900e312231c3c8d382761ed4f1a5d817284196606881398a01b
SHA5120d2afd80055d739b6c4d28e40de16060c5883eee5d4db1824b2a6a7c11685ae21a3a42c2de7e12c878072e1edbb59dbc29d3ccdf20a60f6e4a7cb51e55246e26
-
Filesize
1.3MB
MD5abcd3166cf163a753412b31a9a9a3459
SHA1bced349b179ca45ce4d8692849ae6e6bd90c9907
SHA2561299e02d70f92be87237f73c016f5ac6087d5b01130cf1aaa3feaeb20d76d145
SHA5125662db413879593491b2559c3a92bb2eb774cbcf3d25ef97aaa453d0a8b9776f20452f0b88571f570a38a0e28889d4d0771aefbb9d6f591cc458c083409f8dd5