Analysis
-
max time kernel
120s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08/09/2024, 16:31
General
-
Target
7e7dae10afec3e0c26f1842ca0a7d9c0N.exe
-
Size
178KB
-
MD5
7e7dae10afec3e0c26f1842ca0a7d9c0
-
SHA1
328fa95901d28a84d55afcda681016871a6a0b5a
-
SHA256
7a2d14aa628aab63b12c0508344b64bed41fca3716f67d62c18a955e1bae35f8
-
SHA512
ba7a05dc40656e0dd8be601232dadf8c309d394afc98732dba2ef73c1115ba9b8ebbc5d99ff7c0357ee4bdaef15b0c2eab05b385bc77481bbc91c545a2fce3d5
-
SSDEEP
3072:oi7oIVHpkiOQdhY2wO+IMsx0UCHsqqRDZ71Xh7uYYytjoutxb:oi7oIVJkiBE28QnDBuytjoSt
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 32 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e7dae10afec3e0c26f1842ca0a7d9c0N.exe"C:\Users\Admin\AppData\Local\Temp\7e7dae10afec3e0c26f1842ca0a7d9c0N.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Tencent\qq\776F686578\AFKVY.zz"C:\Program Files (x86)\Tencent\qq\776F686578\AFKVY.zz" -z 423B5D51736E6673606C2147686D64722129793937285D55646F62646F755D70705D363637473739373436395D4256542F52495B2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\mobsync.exeC:\Windows\system32\mobsync.exe -EMBEDDING 423B5D51736E6673606C2147686D64722129793937285D55646F62646F755D70705D363637473739373436395D4256542F52495B 02⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming 76F6865787.exe"C:\Users\Admin\AppData\Roaming 76F6865787.exe" -3 423B5D51736E6673606C2147686D64722129793937285D55646F62646F755D70705D363637473739373436395D4256542F52495B1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe -sys 423B5D51736E6673606C2147686D64722129793937285D55646F62646F755D70705D363637473739373436395D4256542F52495B 02⤵
- Deletes itself
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179KB
MD545cdb495f94ef70bd466c8c445385bf5
SHA101c2b988cf50276c62cfddb472188a07575e1948
SHA256d22ff611b4e0adf18051a922bb42a960c303523dac27c826f7909eb279c49ac7
SHA512d53ed17217dc33b93a44b31cbc5ecd1ca8018d2c3635da5471d5dba2f5d0decb7f223a4ee3d2ba5928b0450b9cb7501cffa76d41fce418adc84ac353937301a1
-
Filesize
178KB
MD55f0e54dd6efaa80867307fdd6dfc5370
SHA1d9e9ea2355b99faea95d1ecf4af7cd06218b2e7c
SHA2561f97dd6627a1f22a50398109d5109b24a25c29c5b49e8e87bae58d0ebb14f03c
SHA51219422567fa0af5c24d43120d5149237c5f3d0011a1c65493829a4a30d138c1157bfddd16a59d86db0b7f3899fdff5fceefe726a2c645cac3866257b15cdf0a5d
-
Filesize
1KB
MD53b4885d7266e8aeeabc88315ef39b52e
SHA17e41af8837655422330c1d204970a41df175543c
SHA25680e65c0922983c32412af8eafa30b518af7dd3888a3ebd5661668655bf4dad4b
SHA512453ab13c4f0ff892795bc24702bac47717eb82b62dbbd9082ebc5687f558c54b5cf27af22b7c5a2e6b35f19633a0f17f883b2fb84082980c9fadff262b7e7b96
-
Filesize
10B
MD52b1c25401a6b8077d821c519264f056f
SHA139ec286dcc679ee6459d7e8b42d254294234bc0f
SHA256028095cb0e6f1453ed24b0457726fefc31913fa74e19be8bd6bf7d82b94a5a39
SHA5127cf60d1c7cbcf2a9800579587388517145ef2b965e4b8406d054862500f3cc86579e0d066be03ba95ac6bcf6ab8f566e930046a1731043eba91e92fc58c3856b
-
Filesize
10B
MD51f536f62b71ec4a409ffee49841a3a2c
SHA1c69bc06b6c3d7407dc0a022ce4993bfbeb9f9f76
SHA256f3b24e49af2570fbb8dc960319f856af2a02e4b4ca897a25d0afca04739d875c
SHA5127b5238f3eb07c1df8c1035b737f2080d3b5e5b068f1516d39cf0c32dcfd761486ab22babce1e15fbb2d11177386ccc58ffe85125b8befa57d9bcf3ec39fee71d
-
Filesize
22B
MD577c001c62fb95d065e34ec25e5864fc0
SHA1bd38b0eb0e33ab931fb0d356358b9c086f4997f0
SHA256decfe4ed60f15089019fa10459c9541b270d767900078f420a4b07458d592c67
SHA512ca610a3e18f92731108c6038212256be655fc86c6e5284cfc4484e987f436aa1b3922feb623ed04888a5e80576cbd1beb5cee3c6200ba3c17b303e4b12306f1a
-
Filesize
109KB
MD500a51edfd6a21ef8bfaad17a05ee8776
SHA1aebbadb726daf64e65127bbd024cc56dcf41aea6
SHA25658dba017c96ef288d5ed3d46ce3d41a9e371933c355c515e4165e80acf564f58
SHA512cacc2be13301d5570a5260b6fa91be23273b5b7db26b57c1ba955b1c74b60c9659aa81146f4f23c82983a96ffe69b161576a20de09937eae8f6833ccf608ca9d
-
Filesize
73B
MD5ad8359d170dde6ccc27a8fadf297b2ed
SHA1364e62b79e421e24bc0e99160cdce09ca04a167f
SHA2568011269557f0a54e7966d4e434d4f83b3c09cf2bc24c2ade275ad1f87037cdd4
SHA5122c46d761f3c612c3cde00ddd84f139e954e73d2c434212dce11fe1a5782985cf9f235e16a5bb190f39981d15df89d6f2b0bec6c728a66c2eafefbd51272e2ef5
-
Filesize
179KB
MD515708cb205822f1fde9b15d8d8a82ea5
SHA1a260c12c656e891680a702803f9ca14f4c803c0b
SHA256bf66b5b6a6f41baf6fb140bd9cc5af8ed38c095bfea8c9623fb959c28304b163
SHA51280089f98ca547b9ef6394db56ee6bfe7a32fa0e8f71e3e842c43c5449f7ef33a974e970bfa991d0e06bf8e3c5590d708a6a8cc7400a675ec4face1dab798199a
-
Filesize
625KB
MD5eccf28d7e5ccec24119b88edd160f8f4
SHA198509587a3d37a20b56b50fd57f823a1691a034c
SHA256820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
SHA512c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
180KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
180KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB