Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
06/09/2024, 00:16
General
-
Target
f168be9c023341488f6caeb21563c670N.exe
-
Size
175KB
-
MD5
f168be9c023341488f6caeb21563c670
-
SHA1
1b32a4d9018ac122b1d9f2080be9ce06560dac78
-
SHA256
13af4e4a2ddf76ff36a71112b457e8e5627abf33ef5889d7538def3c0c03fdfb
-
SHA512
fbd880257aec00e172f4e65a8d5d0d70bb9ae5c81f9ac72f23f120ef31bc0fc339a6335bd4baeada3fe506782a08c0bea0a71db30cb50d1f5e967f9a3167c905
-
SSDEEP
3072:Xi7o7VHprGPGlyvfB5D6pEdDXONu//847FRtoutZpJP:Xi7o7VJaOUnB51DXOv47FzoSfB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 35 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 8 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f168be9c023341488f6caeb21563c670N.exe"C:\Users\Admin\AppData\Local\Temp\f168be9c023341488f6caeb21563c670N.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Tencent\qq\727B6D6173\PFJXY.zz"C:\Program Files (x86)\Tencent\qq\727B6D6173\PFJXY.zz" -z 423B5D51736E6673606C2147686D64722129793937285D55646F62646F755D70705D363336433745373036325D4A42502F5548402⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Users\Admin\AppData\Local\Temp\f168be9c023341488f6caeb21563c670N.exeC:\Users\Admin\AppData\Local\Temp\f168be9c023341488f6caeb21563c670N.exe2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5985f50b3626195b2213229654c04b62c
SHA1dcd76f050421beb7f07554bedc00e84ea031f3ac
SHA256ed7d232e1db5850542bc9f72ef52bd17c54909f628e6ea4b660a0d780a56654c
SHA512a9c6136d3a402507728a931cda6a0634c8b80065df034ee15ddae5ec4ce6b8160c15bc5314b35564797b83b88694a686bdd5aa319c363aa86cd9b228f2fc6377
-
Filesize
1KB
MD5f527f1cc382565a06de77bfbab213be6
SHA1e9dd470d06ae59eccb5aecc020a96a877ab841d6
SHA2566f1448d4216de766a41f29d11ece93ac15c6b597ce7d93120bc2e1a71bc67bda
SHA5127c8cee035033dfb67cc21e72a1dabe61ac2548d3b995adf544278d85a9f43ff0484b82a3428a41dbd53bd7b17dbac5e9197d2c2e7aedf1e4ba3884f4cb639ac5
-
Filesize
22B
MD5eb4d00f651645e390943aeb1ce9828a8
SHA1b38a539150d805ce92cb56563f66c3498273c9bb
SHA25654e311b27f481b97d4851f2446ef3a5a75687793bb9408733d9ab9aa7024b830
SHA5124d0c2ae53b7a018f2a77228d279dc096eed52f095a13e3b5cd7ebc1a711a6fa4ed77c90ccc869f610139efd67631860f37920759ab4fda8428c4343428d52fb1
-
Filesize
109KB
MD57ad6c16975b966367d5741310bb3a062
SHA162c0dba41307541f3ae9e8b05c8c76996bb56e36
SHA256135fb2b87d31aff906c4867cd64e651bfe1e18b6b1f2c552a533f474563762d9
SHA5121c3e8215107355a7993ec0cf605e0ca8645ab5bf7fc83ae0184f33c1b206fe6c8c23cd80cdcdfaceaf9e37d630955560535b12620b441ae732b1f033bfeba52d
-
Filesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
176KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
344KB
-
Filesize
176KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
176KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
176KB