Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-09-2024 15:21
General
-
Target
xkxkv/dms.exe
-
Size
34KB
-
MD5
dde4e4e601e8b0e7d1621167b709adb4
-
SHA1
cf152fff93d8bfc7bcde44e41954a36600c4c599
-
SHA256
53a5ebfe5356da897d550be1017f0c7334d8d9971288abf1398661e288cd983a
-
SHA512
f9b561ea64f374fa3548a09e26a00ea07baa2fd2d328ebc3668e793c4ebd6c44e8f66f04634a8e3f87b6888f60cc4eb663d073f4384a49b8a435dcc56a6ac8a4
-
SSDEEP
768:ty7FJl5/ija+1IR14B38gBTHEfIYMqUVii78e/h:tCFJ/458uIyqU7j/h
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xkxkv\dms.exe"C:\Users\Admin\AppData\Local\Temp\xkxkv\dms.exe"1⤵
- Checks BIOS information in registry
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.7MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.7MB
-
Filesize
64KB
-
Filesize
4.7MB