Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/08/2024, 17:36
General
-
Target
7e5686534daa15d157afdc47d39d1620N.exe
-
Size
2.7MB
-
MD5
7e5686534daa15d157afdc47d39d1620
-
SHA1
8b2d471c577c7f077367a94303aac42b00f08b47
-
SHA256
7c5b4f98977e6d2da77225e492bba5bbc5e68dfb56da1ee84458894802f2ecb2
-
SHA512
a2a19a30fe2ec38e281e0737eea4bf844c7191ef74757a2378c17cb24ad52d30fda09aa972f41152eb6e360a8cd8ec43b42f0cd7980476b79eb0b9f24568fa0d
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB59w4S+:+R0pI/IQlUoMPdmpSp54X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e5686534daa15d157afdc47d39d1620N.exe"C:\Users\Admin\AppData\Local\Temp\7e5686534daa15d157afdc47d39d1620N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\AdobeRD\xbodloc.exeC:\AdobeRD\xbodloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5070712568221c5ad34303a589b99c6a5
SHA18543db3eafe83f564fe098fef304bfa125cdaf6f
SHA256c1fe88757a88f99ae8bebbf5c33793068bea0d89176d7df01e11ee1d4a3231ad
SHA51248cb299445f711af77438ed56d68cfe89da85a41ee0144e8f3c8a232cd54f28d383918d78df715548ac95595d2f0c9fdf59b8371971ad2a3fbec04f629b11d8f
-
Filesize
2.7MB
MD5f1feff2692c687f7d33216bca43da5b8
SHA1c7f39a3f5fe492936eae6b9e1fd7f227a632833c
SHA256426e83b78831ef7c45d81fd053758db76712225013d1483972ea2a92e8e0ff00
SHA512f2f91cb115fced07e0bcadf43613d4274c270e64b631bc06e122e728c757d971435106209f9a62041ba8f017323fcd1f993756b38ae8acc2aec0e71101c5eb3c
-
Filesize
200B
MD5fd31db1f7f21f713bc20a9d38046ebda
SHA1f9196f7675410377633e47747fd4e88697bb601a
SHA256d8c4076b2029864755f0a15d979bbc8e746bfb9b8abe9c0680b4de01b1a33f76
SHA512ace8c28824127b38f4f2f7ed3e5602ab3d6be6d13c0ed110ab99f3f3f4a14e104f6de76c43fe1dada66fd91d37bad2b4754bc8f56b90ff81b5dcc85f5916fa76