Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
20/08/2024, 19:54
General
-
Target
9fe0ab970b877025452af85bd8c25670N.exe
-
Size
2.7MB
-
MD5
9fe0ab970b877025452af85bd8c25670
-
SHA1
a4d7969dd07143fb2c9bf4e624513d390b5fc5dd
-
SHA256
53411f4db2668510791a0b96257c7fce51a4130a5bf81b446db23df9184c53cb
-
SHA512
c2ff61f16d140b3ff50bd4b79d2585c0aa2c3fcea5d5df9728090cde8705423428810ca721f8cbc4580ee6b4b0c71041dfd04ead99cb06f0a0a5babeba001dd6
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBO9w4Sx:+R0pI/IQlUoMPdmpSpU4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fe0ab970b877025452af85bd8c25670N.exe"C:\Users\Admin\AppData\Local\Temp\9fe0ab970b877025452af85bd8c25670N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\FilesPC\adobloc.exeC:\FilesPC\adobloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD59bc291a89d132345a6c171724949c759
SHA1ee24b52218f9c97444f29e0be4f4575a61437b2d
SHA256df13fc730db7ea353e6ac69e0bce83346a778d8873b3dd65cec8b37d61d3bf32
SHA512150d2fa92b9c5a88aeb805b84a0b0692e1b7e6aba900846be837c0bf80b674a5467811a512818f57d5954b486be033b67512eca2c53e417dbbae54a45713032f
-
Filesize
203B
MD507d7146522ff44098be62d33a5898828
SHA17f7c32b0e8a19123d2022c55ef9d4113c2c1afea
SHA2567d2a44f12049ceda49922b9d5e4fd63d1c99a100a1227e98642638b358b44ec6
SHA5123c7696d780259ec1ca77b021a8c388e6b53bf8204b674829ee08462fb59e89b7d92375251c6387e0d5821d311afe00c03354271245d11c58cdb3cb6438ca8e71
-
Filesize
2.7MB
MD5da1d7513b41c5caba46e83b51c78f0d1
SHA1dbe2d6c7b7e78dc8bc147a8e6ca44905902c8b41
SHA256c8418038283d2859f08f0f37e8af5f454d81dfe5675622c05a37608552c79625
SHA51229ed3d4eec05d245fff00c69b5925fc0b0504900affbee4c1aeef3881d99a79df241c9f8b63566cbeedb5aedc57704b7aafdf74e0892026464732726b1d00ea1