e6594594a326e96fa32d833adc915c58599a9dad06ad79a4d5ff8a0e6afd4438

Analysis

max time kernel
140s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
02/09/2024, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

app.exe
Size

4.0MB
MD5

fa8fb8c033fc9c915a5ca2a68fc0e3f2
SHA1

f7299bf90841e4e01565fdef6afa3a84b8e862b7
SHA256

e6594594a326e96fa32d833adc915c58599a9dad06ad79a4d5ff8a0e6afd4438
SHA512

d139c3fdda13a7ab6199f42d1dd7ef1dd33a2fdb214396e658e8396572dd60c074ac1ead171337a5a449c97f9e3d19bee27a243c05504604294734a1fe9b56ef
SSDEEP

49152:b8Ke34j6f48/+RpKliVliU/1j/SEE45ht8FyZK:bz6f48/+JiU/3E45ht8FyZK

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ajlfksd.exe	app.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ajlfksd.exe	app.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	discord.com
2	discord.com

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1656	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1656	vlc.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1656	vlc.exe

C:\Users\Admin\AppData\Local\Temp\app.exe
"C:\Users\Admin\AppData\Local\Temp\app.exe"
1⤵
- Drops startup file
PID:3188

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3904

C:\Users\Admin\AppData\Local\Temp\app.exe
"C:\Users\Admin\AppData\Local\Temp\app.exe"
1⤵
PID:5068

C:\Users\Admin\AppData\Local\Temp\app.exe
"C:\Users\Admin\AppData\Local\Temp\app.exe"
1⤵
PID:1848

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\TestComplete.m4v"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1656

C:\Program Files\Windows Mail\wab.exe
"C:\Program Files\Windows Mail\wab.exe" /contact "C:\Users\Admin\Desktop\NewWatch.contact"
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-13-0x00007FFF14610000-0x00007FFF14628000-memory.dmp

Filesize
96KB

Download
memory/1656-37-0x00007FF7F9650000-0x00007FF7F9748000-memory.dmp

Filesize
992KB

Download
memory/1656-40-0x00007FFF02CF0000-0x00007FFF03DA0000-memory.dmp

Filesize
16.7MB

Download
memory/1656-11-0x00007FFF14630000-0x00007FFF14664000-memory.dmp

Filesize
208KB

Download
memory/1656-10-0x00007FF7F9650000-0x00007FF7F9748000-memory.dmp

Filesize
992KB

Download
memory/1656-17-0x00007FFF12DD0000-0x00007FFF12DE1000-memory.dmp

Filesize
68KB

Download
memory/1656-19-0x00007FFF12D60000-0x00007FFF12D71000-memory.dmp

Filesize
68KB

Download
memory/1656-20-0x00007FFF03DF0000-0x00007FFF03FFB000-memory.dmp

Filesize
2.0MB

Download
memory/1656-18-0x00007FFF12DB0000-0x00007FFF12DCD000-memory.dmp

Filesize
116KB

Download
memory/1656-12-0x00007FFF04DF0000-0x00007FFF050A6000-memory.dmp

Filesize
2.7MB

Download
memory/1656-21-0x00007FFF03DA0000-0x00007FFF03DE1000-memory.dmp

Filesize
260KB

Download
memory/1656-14-0x00007FFF130E0000-0x00007FFF130F7000-memory.dmp

Filesize
92KB

Download
memory/1656-39-0x00007FFF04DF0000-0x00007FFF050A6000-memory.dmp

Filesize
2.7MB

Download
memory/1656-16-0x00007FFF12DF0000-0x00007FFF12E07000-memory.dmp

Filesize
92KB

Download
memory/1656-15-0x00007FFF130C0000-0x00007FFF130D1000-memory.dmp

Filesize
68KB

Download
memory/1656-23-0x00007FFF12D30000-0x00007FFF12D51000-memory.dmp

Filesize
132KB

Download
memory/1656-24-0x00007FFF12420000-0x00007FFF12438000-memory.dmp

Filesize
96KB

Download
memory/1656-29-0x00007FFF02260000-0x00007FFF024B3000-memory.dmp

Filesize
2.3MB

Download
memory/1656-28-0x00007FFF02C70000-0x00007FFF02C8B000-memory.dmp

Filesize
108KB

Download
memory/1656-27-0x00007FFF02C90000-0x00007FFF02CA1000-memory.dmp

Filesize
68KB

Download
memory/1656-26-0x00007FFF02CB0000-0x00007FFF02CC1000-memory.dmp

Filesize
68KB

Download
memory/1656-25-0x00007FFF02CD0000-0x00007FFF02CE1000-memory.dmp

Filesize
68KB

Download
memory/1656-22-0x00007FFF02CF0000-0x00007FFF03DA0000-memory.dmp

Filesize
16.7MB

Download
memory/1656-38-0x00007FFF14630000-0x00007FFF14664000-memory.dmp

Filesize
208KB

Download
memory/1848-2-0x00007FF7BEC60000-0x00007FF7BEDBE000-memory.dmp

Filesize
1.4MB

Download
memory/3188-3-0x00007FF7BEC60000-0x00007FF7BEDBE000-memory.dmp

Filesize
1.4MB

Download
memory/5068-1-0x00007FF7BEC60000-0x00007FF7BEDBE000-memory.dmp

Filesize
1.4MB

Download