Analysis
-
max time kernel
59s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13/09/2024, 07:31
General
-
Target
925e7ac0969834f88dee3f2678664167d5829ae258e06da169bdad7e5128bd2a.exe
-
Size
2.7MB
-
MD5
84d37bdcf8aa60a2e3cf01b5f2843aa1
-
SHA1
36885fa3b72c7040ee20b1127015ac66e1220373
-
SHA256
925e7ac0969834f88dee3f2678664167d5829ae258e06da169bdad7e5128bd2a
-
SHA512
eb7b80ab6bd390588b1f2fb0ca06cf95ff0cd713186fe7ea08035f1582e3da246418497c3031fb453f867ee590463010e6695c874b99eaddde3cdaa6ff7b9ffd
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBZ9w4Sx:+R0pI/IQlUoMPdmpSp54
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\925e7ac0969834f88dee3f2678664167d5829ae258e06da169bdad7e5128bd2a.exe"C:\Users\Admin\AppData\Local\Temp\925e7ac0969834f88dee3f2678664167d5829ae258e06da169bdad7e5128bd2a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecdevdob.exeC:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecdevdob.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\UserDot24\xoptisys.exeC:\UserDot24\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD50030ce39b3e0edc33f527e370beeeabb
SHA1459513da0b5d6eaa176ca314b77b0ccaa938e7b5
SHA25656db8055acd824c9cb547640ad5ae6d5d3526b0d4f6b84a96f52524b63e6d0ae
SHA51252d9dc81501580bcf7593728b28616f1df064a017b41c9ae8ea59327f46ca73ac30d110be48d2dbf63e897f3ab0546f8411a5210dee6d5d1d2bd672b0d6b4df0
-
Filesize
2.7MB
MD5968b5f7b0a71eb61743e1d03a1e66dd1
SHA1fef7144c064096728628f8b7a2675ea7724f85b0
SHA256ff3499197124dc1bc258154db12718707475b019b40104bc529beb3ef1eca435
SHA512bbe077b9cbaf32644ee870e47bdf4a73f94e841f3a06f6e9aaa04e78e709ba10e22cca3c7d677733d2eaedcee5859d0003bacd17424148e29e876e6a8eb9a97b
-
Filesize
2.7MB
MD50d2d9d00d929c158a89756d112e81d33
SHA1bcf64826c2093e0e556e7f95ca29e0c208c2ca03
SHA25664dc88896406a858e9704b77643b830118d8f571b2fba73fc1263baee5a84c80
SHA512190c94b30d8e6371028da1e79cf78bf86ac318e388fc45d49b5d07872982a179d79e3798e011694ae630259ed1e55916913bd948282142575584cdb9768fc5c6
-
Filesize
207B
MD5658b5ddb4658133df2b1a6ad5bd92e38
SHA14c17bde95c23ea909fa6f6f280823e709e97cfc2
SHA2566ba8f588f3748bc287cfc7384420b9a58af6415523461145ea79a43282bc5402
SHA512d4ff8d4177f92aabd1da056b3bcb67627fc07c942c7b8a802184fc86d4038a380b8aa5d5b54b79220f190c082f24055b19f30f3e45f6d35b521a74a6d2088f70
-
Filesize
207B
MD57a7bf7ca877d722cdd46fd750d43119e
SHA1732baaabf5234d7a434d089df9797d5c8f5cd599
SHA256bcb781a62baa888555612f8b2b0a2f020f378071050c943df47df60308844c83
SHA5127c77c8ba986b990515540a250954e2990e73c9b31cb9d764c5ca7369fbcebe82e6dc7ac6a2f7efc1a35a9d3eeb55a3274d972784a7cdd9ff3a7124a7ff8e44cd
-
Filesize
2.7MB
MD5041617f0009f67f2f153de1a992ce402
SHA17cbf7cda1e64f35a1c2c5c356899dfb11e97eb88
SHA2561d7d0f5cd10019a9adfaead2a10c5924ef58275692ac9755eae214ef595993ce
SHA512b1507e3f878e946ff92da50866090520664ff55e3caacaefc34fe530ec877bb86bf80a4d1fd0d298899c31382451d2d58b4b25f1b09e1dfc3d1f7dad930c89c1