Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/09/2024, 02:56
General
-
Target
ecdb6e2634d1b661065e23ec0d17f343cdc3bfb8728fb726b0fb53eacafd0987.exe
-
Size
60KB
-
MD5
b4b15e9f9f3e2a61eb0f2ac2c5c54260
-
SHA1
c14f78bc224224460355024fab8127d83f3180ad
-
SHA256
ecdb6e2634d1b661065e23ec0d17f343cdc3bfb8728fb726b0fb53eacafd0987
-
SHA512
14262e39621be22224bc37a3a31ef4bffaf8e146fae51ca78d940677b4d1d2170f80259ab51093a85a67ba768fd9de36bbe8ff89e3c9d243f119947f1cc7a1ab
-
SSDEEP
768:9qSqC8+N5ozQQsncwxWmNXMX3cX8wtgtzpAXpX8/X/7CUrfbtS6qO:9rqfzQQsamN8835mv7CUronO
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecdb6e2634d1b661065e23ec0d17f343cdc3bfb8728fb726b0fb53eacafd0987.exe"C:\Users\Admin\AppData\Local\Temp\ecdb6e2634d1b661065e23ec0d17f343cdc3bfb8728fb726b0fb53eacafd0987.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\8a4afc33\jusched.exe"C:\Program Files (x86)\8a4afc33\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
60KB
MD514b4956eb83c02026ab14101c49272f8
SHA1adfa91fbd5237393ddcd5d0d4845b30804cd8d30
SHA25621da79b0e18c5791d77031c9e1e2df361ed1db406e6f1fa2e713910f9accfd0b
SHA512d170d8ec5d672b74ad6042a150da6be449ad11893ab14d1da246136d83bc135b3026ab826c948b3a40aa01ab910af1914ad5248edb866ef2d65c3b1b05b66120
-
Filesize
20KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB