Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/09/2024, 05:24
General
-
Target
56ebdf6be856006b680088ac9ba9999fbb48f640f7c23b678777890add3d7c9f.exe
-
Size
79KB
-
MD5
5e1b563d08572f43d5abe3d9cbb17bdc
-
SHA1
5ad0adf13e7cf9560945e7bb4699b82261189766
-
SHA256
56ebdf6be856006b680088ac9ba9999fbb48f640f7c23b678777890add3d7c9f
-
SHA512
bf91e22995453ad10e61f6c8f2ccdc8708c37635c9f2d545a17df59396fe18af5abdf701eb0bddd9c917e1594bd70c8c21c6eea9ef1fc06b81bc5d8a908bd346
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWO5J:RshfSWHHNvoLqNwDDGw02eQmh0HjWO5J
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\56ebdf6be856006b680088ac9ba9999fbb48f640f7c23b678777890add3d7c9f.exe"C:\Users\Admin\AppData\Local\Temp\56ebdf6be856006b680088ac9ba9999fbb48f640f7c23b678777890add3d7c9f.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD5370a9fc91e70f74cc8e5ae2dc6538ce3
SHA16005fc14299398d643e824dc90a76594e6da64e7
SHA256047dc43957b918e9a36ab61ac391db3f45648dbcad91834c87d783ef6cd2c7a8
SHA5125d98939a4d3fbe67c03b6c1fbe1c6e36e1207182ab382a4f6f2fd633fe4d7bd1a6edf70e03c210047607d9f9471f61673d3edc2cd974163ee37740f3fb80b698
-
Filesize
79KB
MD554fa43044d4d9b3fddb1371826204588
SHA1e732ca5d2e4180e62b28d00476d4ce06ff24567e
SHA25607f8f926398f4ad14e6ee16870cfab7e32fa52d9b0dba34c1d41b2146914d137
SHA5128e54430b1ae4f08de2388dc23ab51a0a34df31ea4eaf445c7d81264dd31d7a44c9239a7d5fd494786aadb6803bd6c74b7b5ac5a404af5877f9d8041ccad55eb1
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB