Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06/09/2024, 13:22
General
-
Target
f0c2a5efb9953b27d3337f7c457798c0N.exe
-
Size
202KB
-
MD5
f0c2a5efb9953b27d3337f7c457798c0
-
SHA1
f4e185f5d6eb99ee6f86bae1aff1bb38a99133e8
-
SHA256
c65ef0fd86e121b47c5299efb853249da623ab49cd94e4cbae4c760e87575803
-
SHA512
a37397703832d691a516f3fa5e49a1d822f7114433e310415febaf4f83a116407712e4aca8afcff83d399f6488eed9721a072da10f8f34b9f2d8003fedbd3eff
-
SSDEEP
3072:0oUvg4fqjO00Yhxumzc6QIFqC067xd8xYCm9YvQd2K:0ojV0Yvzc6QIFqCNFd8XjK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f0c2a5efb9953b27d3337f7c457798c0N.exe"C:\Users\Admin\AppData\Local\Temp\f0c2a5efb9953b27d3337f7c457798c0N.exe"2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {6C15DB1F-7E3E-4573-BCCB-94CEE9A8F257} S-1-5-21-457978338-2990298471-2379561640-1000:WOUOSVRD\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~3\Mozilla\ndribzb.exeC:\PROGRA~3\Mozilla\ndribzb.exe -eciltya2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202KB
MD5a3b75274e7912a58ded40251572bc40f
SHA1dd9d86a53da94e71b5995bae3d9997c543d6fe32
SHA2562954f2a1414e1df8a171c9cf64c2e65f2820f0dc49b83fcaaeb0cb9dd5256ad8
SHA512f89714d9f51688c0f22090cee711f351c4e37cb811dff217fc51761d7b1fb0080a9e5a3da6c7ae7a19c4ad7b45abb52a8e6c19843a44829e943c5cf44201d7c7
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB