Analysis
-
max time kernel
96s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 02:44
General
-
Target
d591e67ebd5433c9deeb27066da4bce0N.exe
-
Size
468KB
-
MD5
d591e67ebd5433c9deeb27066da4bce0
-
SHA1
cd721be82f3d80daf925e9f5d8244c237f3aed95
-
SHA256
442fd96236342f9e061551efecbbed0ab015ffafb750ccb02f98891813b22a60
-
SHA512
5c05ff6567c34fd7159509d1a18db1e68dca501ce4c3a0c8f11a984821bb79738391017b140f57b9c8e052409bf9c500e60cd703c77f4e10a62d8d2aa1135cd7
-
SSDEEP
6144:QR5YGq/6VOAFdljBt4vvB8oQUQ+NCIRlavBe:K0h8BYaRU9CQgv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d591e67ebd5433c9deeb27066da4bce0N.exe"C:\Users\Admin\AppData\Local\Temp\d591e67ebd5433c9deeb27066da4bce0N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\Qhoqaa.exeC:\Windows\Qhoqaa.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 9443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3080 -ip 30801⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD5d591e67ebd5433c9deeb27066da4bce0
SHA1cd721be82f3d80daf925e9f5d8244c237f3aed95
SHA256442fd96236342f9e061551efecbbed0ab015ffafb750ccb02f98891813b22a60
SHA5125c05ff6567c34fd7159509d1a18db1e68dca501ce4c3a0c8f11a984821bb79738391017b140f57b9c8e052409bf9c500e60cd703c77f4e10a62d8d2aa1135cd7
-
Filesize
364B
MD569e795581f1fabb531871b9d438809e1
SHA1bed8755e8afe9661aa8b0f5da221a3f2eca217d0
SHA2560f45e2942d705b3cbf2f2b79efd599d7b548513af44f3ed310e7d7325c64659a
SHA512a38607c4b1b196f811a2aa95d19bc80f4541c356985654972d59353e8c037982c46a2fcacae27690bdb3230b451b993ed2fc068d8986274837ee223afae64015
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
476KB
-
Filesize
4KB
-
Filesize
476KB
-
Filesize
232KB
-
Filesize
476KB
-
Filesize
232KB
-
Filesize
232KB