Overview

overview

7

Static

static

3

25a4a3986c...0N.exe

windows7-x64

7

25a4a3986c...0N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2024, 21:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    25a4a3986c3a61321ba596136d0bcf50N.exe

  • Size

    2.7MB

  • MD5

    25a4a3986c3a61321ba596136d0bcf50

  • SHA1

    8d8cbefc0a721473f57733a1fe54d4f03af089eb

  • SHA256

    d3e8eb75da9dcb9f87770de67fa8b52bb945edb99c56e0919d8ef148d692b325

  • SHA512

    abf819baa629624023faf18f6088a939bae0c1ca3b0d6f058b50df6f0ae8adf0f5096172d94ec7e41408debd889771b75d8364ae8431705e1db8c8f57e7c4e5f

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBa9w4Sx:+R0pI/IQlUoMPdmpSpU4

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25a4a3986c3a61321ba596136d0bcf50N.exe
    "C:\Users\Admin\AppData\Local\Temp\25a4a3986c3a61321ba596136d0bcf50N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\AdobeVR\xoptiec.exe
      C:\AdobeVR\xoptiec.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2768

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\KaVB6F\bodxec.exe
          Filesize

          2.7MB

          MD5

          2ba0e0b5ffcfc0ce3b1d62ca7f6b17d5

          SHA1

          c81f478ff4bbf88ed1c0a6188da9ea5c0b8ce72d

          SHA256

          e6dee24106098ac954e1c039f930f6e1a48e2a7da792d11265a52358a03e4ace

          SHA512

          f47a6d135835c54f9d69f0673940d05586ceb0c5cc45212b173d40c95a2340c988b7cd7c368abc4e89fb8446be43f297b87b3a5825ac6ddfb6e44771b7b36c46

          Download Submit

        • C:\Users\Admin\253086396416_6.1_Admin.ini
          Filesize

          201B

          MD5

          b7045f32b5b85b495ec1e1ecf29f4992

          SHA1

          91dab28fad1c590d17937220e75b39afc83978f8

          SHA256

          33586b24059335b44f04505637cd2cafadedb7a03817a3826fc92fdca3fd2ec2

          SHA512

          84ab97e945b8befbc8fcb97f1e56a8679dacdf979ff10de07ab743ad77348231a98bd6087cef0777517aba471908e78d1c1332d0a113ee1925365ade5857d032

          Download Submit

        • \AdobeVR\xoptiec.exe
          Filesize

          2.7MB

          MD5

          3401213e8aa202d52344b473a2b0b214

          SHA1

          94da5e9605945b6475c23092b78f6e4ba03f977e

          SHA256

          c309aa8153b416fc0799ed43a1f5027b34301905cc82b09a1f9ef5a08bc1503f

          SHA512

          049c4207dffba35c5d55570b0c9f72de9519bb7ef16285395b596fee5c92befd0041e57d220abe0bf0eb6c31ac2160ef7ba095266053e7d1fc65f7aaada52410

          Download Submit