Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-08-2024 01:44
General
-
Target
698af3c26c7433818ed532e8d84b525f34c88b99f30ccb543e24102223e2ebd1.exe
-
Size
1.0MB
-
MD5
07ebe6bd39d47f8d9533d7910497510b
-
SHA1
050bd05707529b4fb46608b276682d4be1fcfb88
-
SHA256
698af3c26c7433818ed532e8d84b525f34c88b99f30ccb543e24102223e2ebd1
-
SHA512
68fd8a9e4e25452142365f93657482839bef10dd6b88ea0f36ccc0f4dfbe79463aa13c84fcbc4148fa530c1a665e30f9a72acfbb0379368b5fc56da3473d044f
-
SSDEEP
12288:otXlW6JhG2lO8FbG5byJR//uXShuqO3daKScHj/mTnGM:otE6JY2sYS5GJRuHkcHqTnGM
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\698af3c26c7433818ed532e8d84b525f34c88b99f30ccb543e24102223e2ebd1.exe"C:\Users\Admin\AppData\Local\Temp\698af3c26c7433818ed532e8d84b525f34c88b99f30ccb543e24102223e2ebd1.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\flexxloader\tempver.exe"C:\Users\Admin\AppData\Roaming\flexxloader\tempver.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
876KB
MD56d6a1f28978d42ad2f0a8f278eaac966
SHA1b09168ec88109422ca29cf4f1b6462d51930873d
SHA256fb23fa4fca8f28bebe7b7e39593a211cd3c3405de5f948ec520e859b1bcaf91e
SHA51276ddf88255a9355fc3c781880e23d94206acca4decf5623712411f7a733e91ca9ea37944860401cf9667f10e8c33a087803a4726f91faff1f23e3e0592ddf41d
-
Filesize
2.5MB
MD5bc4706d4725cd7eaac614d28213d51fd
SHA1e24131db024287999645090fd632a6ede006262e
SHA2565d1298922e0d261c67d4bbf229fa32c4aacb8c3fdf9bcd8243802a4a7e3349b0
SHA512239fb423c2cec36dd6de48e81b7b681bed55cd1a35b31f18c4119202369ff6a60f8179adfb5b60a05af6681c44bb539fd4ced69ebdeffa4922f39e5818c91777
-
Filesize
264KB
-
Filesize
10.8MB
-
Filesize
2.5MB
-
Filesize
10.8MB
-
Filesize
896KB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
1.0MB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
10.8MB