Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
25-08-2024 22:12
General
-
Target
896a6b3230fecefdd77efe8e7a29aa517aecc0d126f6cfae08b8112b108e3acf.exe
-
Size
2.7MB
-
MD5
7c235d649523b2a39da9190c65cbff65
-
SHA1
d3f04a2028a326a1cc7eb232c418ce743d8463b0
-
SHA256
896a6b3230fecefdd77efe8e7a29aa517aecc0d126f6cfae08b8112b108e3acf
-
SHA512
1e569ee83ba78d733eb69c9655162fcdb90940dc6efb0318e859ce8e50c254ec230ec333396a2af38f03c9f2fae685759c6f2cf77edc3daef9a6c6776b164258
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBa9w4Sx:+R0pI/IQlUoMPdmpSpE4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\896a6b3230fecefdd77efe8e7a29aa517aecc0d126f6cfae08b8112b108e3acf.exe"C:\Users\Admin\AppData\Local\Temp\896a6b3230fecefdd77efe8e7a29aa517aecc0d126f6cfae08b8112b108e3acf.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Files26\devdobsys.exeC:\Files26\devdobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD510cddceac571820e518770ba5cb29b09
SHA1f2a478c815e76e0f31156b93bd9958d5d48e248c
SHA256dfa363e57ecf59937c1e5f9d6d059c4f928a39ef417c9916d819e2a67f58b050
SHA51220ef3d7bdbbf23cfb4b99cb760e2c8a1f7c0fc68919a8f432c5a5db5f20bd066eb17ec7bd89e11cea93ef93586455da25b483d473aa4edb5088b5c7aef3c41df
-
Filesize
202B
MD5627830812db4fbd984fcda5f859a9083
SHA1ad80b12a1c1a537eb3875c63275ebec8d309a0b1
SHA256b775282ba34662f510344aa36ed57863ffd3b41790af165d9a35276e659f66b6
SHA512e2f2d9a8fdad2f29a1024d4b67b29d4da21193f0d9095688f2732de371039565d548ffbcd728398b2476544d4095ab42a61f72bc69cc6da970c510cfc4a9c006
-
Filesize
2.7MB
MD569f131f93f6189dcb19136f0b3c1f6f7
SHA1645e4d5fb6ccc9b5addc5564e0566de0be216a43
SHA2560e6dcca6fa4697beea064d8e4109481266de3c2335181bb0ff45df76dab65c5d
SHA51202e3965d9bba568fb6c4ac8abfad60161ba742e5ad8dc41bb64e84920f95564cf5922fe5e4471e036b5584341f0bebdc844890be8b202aaccdcdf1461067fff1