Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
13-09-2024 02:44
General
-
Target
d591e67ebd5433c9deeb27066da4bce0N.exe
-
Size
468KB
-
MD5
d591e67ebd5433c9deeb27066da4bce0
-
SHA1
cd721be82f3d80daf925e9f5d8244c237f3aed95
-
SHA256
442fd96236342f9e061551efecbbed0ab015ffafb750ccb02f98891813b22a60
-
SHA512
5c05ff6567c34fd7159509d1a18db1e68dca501ce4c3a0c8f11a984821bb79738391017b140f57b9c8e052409bf9c500e60cd703c77f4e10a62d8d2aa1135cd7
-
SSDEEP
6144:QR5YGq/6VOAFdljBt4vvB8oQUQ+NCIRlavBe:K0h8BYaRU9CQgv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d591e67ebd5433c9deeb27066da4bce0N.exe"C:\Users\Admin\AppData\Local\Temp\d591e67ebd5433c9deeb27066da4bce0N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Fluboa.exeC:\Windows\Fluboa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD5d591e67ebd5433c9deeb27066da4bce0
SHA1cd721be82f3d80daf925e9f5d8244c237f3aed95
SHA256442fd96236342f9e061551efecbbed0ab015ffafb750ccb02f98891813b22a60
SHA5125c05ff6567c34fd7159509d1a18db1e68dca501ce4c3a0c8f11a984821bb79738391017b140f57b9c8e052409bf9c500e60cd703c77f4e10a62d8d2aa1135cd7
-
Filesize
346B
MD5eccb40c4a7040eade13490043d929fab
SHA101ffc1f5ab5b1fdd48089c8320d8ada12c4d2f6c
SHA2567b55959ecd4ba3eb5bd68f8c40ceb9faae7fa223146612577e2fd34bf99b0889
SHA512554b89b56879ee3ef8f4ee3bf08dcbc011c4c2f62cb4f61aa867908b27c8f47e6d93ce72da24c5a564d15ed1d22fd0786c4e82ed4ccb74c53664ad7e9fbf86d1
-
Filesize
476KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
476KB
-
Filesize
4KB
-
Filesize
476KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
232KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
232KB
-
Filesize
1024KB
-
Filesize
476KB