Analysis

  • max time kernel
    102s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 07:05

General

  • Target

    0252e9d6becd47cb3e46ee16394cae70N.exe

  • Size

    96KB

  • MD5

    0252e9d6becd47cb3e46ee16394cae70

  • SHA1

    7fd17793721ffe6744301b6c8738c1357fcfe69d

  • SHA256

    a2ad970ef59fcd5644e4db39c4630ed9cb625515dbd7da601135caec94ccd5a7

  • SHA512

    7a5ce09ad8b60f648b05ea73ebb05944058cc76e9f3810776bdb4c8e9a3b16604214552ea2742812ce79cac6276b5499df5041df167b7f046783f5ee7a29a520

  • SSDEEP

    1536:uYUd1DF4T99X2VUinh6GZs5BJ/pI7HmUOlOl7DIe28YduV9jojTIvjrH:uYeDF5VfhFZs5BJ/pITbOlOpse7Yd69J

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 12 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 15 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0252e9d6becd47cb3e46ee16394cae70N.exe
    "C:\Users\Admin\AppData\Local\Temp\0252e9d6becd47cb3e46ee16394cae70N.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4596
    • C:\Windows\SysWOW64\Dogogcpo.exe
      C:\Windows\system32\Dogogcpo.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3100
      • C:\Windows\SysWOW64\Daekdooc.exe
        C:\Windows\system32\Daekdooc.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Windows\SysWOW64\Dgbdlf32.exe
          C:\Windows\system32\Dgbdlf32.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3308
          • C:\Windows\SysWOW64\Dmllipeg.exe
            C:\Windows\system32\Dmllipeg.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4908
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 340
              6⤵
              • Program crash
              PID:4396
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4908 -ip 4908
    1⤵
      PID:2312

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SysWOW64\Daekdooc.exe

            Filesize

            96KB

            MD5

            6e3bc5677983ca11538bc665471de549

            SHA1

            ce9b8a2eadbf8bcceee5b4d60af9d5f2f11a4790

            SHA256

            fa6f917904072a80a1af12b845416b95a3b0228236c2f8ba550f153a85fe98f4

            SHA512

            8eb7fd3f7a11960765eaec72ce55f0adb73fdcfc46a1e9de73b30859780e91f73346ff35d28b0df5819b085aae6b2e378d6575df051b5c5cc443a1fe9c48cf37

          • C:\Windows\SysWOW64\Dgbdlf32.exe

            Filesize

            96KB

            MD5

            4cbe8f597be3d650db7054c3f9ee6cd7

            SHA1

            0d37f6b50145f1dc22f3646b68f985170acbb08b

            SHA256

            33d71ab472fc60b891783d889aebc6a19d5db726555943ff9d578fb8021ecc85

            SHA512

            41ecf391a904a48b363ef76ab9ecdf556fbbd5599ceb0272e81ee443b6bd9638ef1b8288eb381e55533cb44b48f1bef666a238e0c9685a1d43cb23b75168debd

          • C:\Windows\SysWOW64\Dmllipeg.exe

            Filesize

            96KB

            MD5

            20995350d61cdc0e64750ea2768f0245

            SHA1

            6e20c8ef6d62c8255fee69edcf186d6f64eea5b2

            SHA256

            bbae754ea00552a33abe38f62b1120d1340a7d8dd197205baf27f47442b1271e

            SHA512

            2af993e8d33ce601f693a69a73701e66ae36bb3379be8d863300e201b85709d07cc16b245d56c7fa751a90971407d315e33c807706cc10da3f71d93710bc2e1e

          • C:\Windows\SysWOW64\Dogogcpo.exe

            Filesize

            96KB

            MD5

            9837334a14397893dedd3f9cfd80d9e2

            SHA1

            90c6104032e4847cb3be6fb66160e27d88acd0a8

            SHA256

            e0d959f63ff9a99dfca2ecdd2cf8346abe307ca23cf7a44fca8bdb380d20d69e

            SHA512

            cc349c5062e9e696395033f390734a74ec48efc2e186585244e224ac54402b6f5ca4951c5c9de00240e751134da05db68d3b9e550eec469ed8cbc5f399c11065

          • memory/1756-35-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/1756-16-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/3100-36-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/3100-8-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/3308-23-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/3308-34-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/4596-0-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/4596-37-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/4908-31-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/4908-33-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB