Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
20-08-2024 20:37
General
-
Target
8bf62b994617b4b305d7162e907355c0N.exe
-
Size
2.7MB
-
MD5
8bf62b994617b4b305d7162e907355c0
-
SHA1
155a5a449e89431fd616b877020fd0677eb18a83
-
SHA256
03af4a29336a171ee7b72d17cd1ad82ce32371ef93dae4b8245c51f189e43527
-
SHA512
191a07b6812e08cb0e3f6daa8c0c48a03b388d829930522b60128bf18ff799d4333b328f1940fa911f26cc3765cd1c8d23e9acbba25abaff4cd4656066d9931b
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB69w4Sx:+R0pI/IQlUoMPdmpSpg4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bf62b994617b4b305d7162e907355c0N.exe"C:\Users\Admin\AppData\Local\Temp\8bf62b994617b4b305d7162e907355c0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\FilesDH\xbodsys.exeC:\FilesDH\xbodsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5b25db39b7626063f0b5721daab7cf3e1
SHA1ddf3d60e4ee8ff1c351e1fd0dea21726299c02ef
SHA2566bbdf85057429c51da9664bf31f99d3b3ccbb0d48469cacc6c94a3f7dc429715
SHA51236af54ec98ce4d00dc5df88839eb9c38ffd1a12d571fb82163fbfee9c5b0ad1f775af9f23d383aea999297d511420830e2b521238f2c122893c64f8a0d033fb1
-
Filesize
204B
MD5d130aa2c83f759ce077a7acf0766cc1b
SHA1694bbc8ccd35c5f2d23b5339057ce0dba39808c0
SHA256673c8123f34c96ad1924f3a67a91c4c6bfbbad3db3dfa488516db31fbfc1a977
SHA512f7a6c476737ec4197d207bfbb417149d58cba5509a6cb732a21e1e33d30f0aeddc6b87d7f93c1d730a97233e643199ae56398e96fa7f13937574e758ae83ac49
-
Filesize
2.7MB
MD5ab3b7956c402a54583331de7dd7a9fd1
SHA158d3c5d3e18ac029eabcf2a369c8cc15ca1dced7
SHA2568d5e5807b9aedb2001eebfca71b875af40fd92948cba1cc7d4fb0e0df3e220ff
SHA5129d2898fd24f4c9afd2fb4efe284573503133ff2a700b5293596f36535f015e60cd02fad6d05738975a37fa084865d0740234cf0718e026812afa6a5cfaa94c19