665eadbce41987176139de6067f20c3ec20bfda6115b3688d8f0b6a8abcfc088

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

665eadbce41987176139de6067f20c3ec20bfda6115b3688d8f0b6a8abcfc088.exe
Size

8.9MB
MD5

e6780fefce69f33292d5d01ea73b5632
SHA1

725f38f846fcf5e10ec4aa2f43bff67957d04ae7
SHA256

665eadbce41987176139de6067f20c3ec20bfda6115b3688d8f0b6a8abcfc088
SHA512

a27de5a091bebec79558fbf1e30dd68c64cbf288d7e72bd62338810cebf2a2c62d877102e58353ff0126e6c990a44b5527f69e846305620b877d5401b9664f03
SSDEEP

196608:5AydYJbaogx4gABqfTFJzaaN66iknfUXk1CnivMjNs:TuHg+gABqLFwaHCe8s

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2584	665eadbce41987176139de6067f20c3ec20bfda6115b3688d8f0b6a8abcfc088.exe
2584	665eadbce41987176139de6067f20c3ec20bfda6115b3688d8f0b6a8abcfc088.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	665eadbce41987176139de6067f20c3ec20bfda6115b3688d8f0b6a8abcfc088.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	665eadbce41987176139de6067f20c3ec20bfda6115b3688d8f0b6a8abcfc088.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2608	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2608	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2584	665eadbce41987176139de6067f20c3ec20bfda6115b3688d8f0b6a8abcfc088.exe
2584	665eadbce41987176139de6067f20c3ec20bfda6115b3688d8f0b6a8abcfc088.exe

C:\Users\Admin\AppData\Local\Temp\665eadbce41987176139de6067f20c3ec20bfda6115b3688d8f0b6a8abcfc088.exe
"C:\Users\Admin\AppData\Local\Temp\665eadbce41987176139de6067f20c3ec20bfda6115b3688d8f0b6a8abcfc088.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2584

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x464 0x494
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230819.lib

Filesize
1.6MB

MD5
a1df3b7884c175c967505a589ba51da2

SHA1
7aaf570e41a00149134973d00f4efc09c4b650c2

SHA256
c16014329cf6f242a525f6782dd10f6a4d0ff6f97239710fdc45522f5c6da525

SHA512
12b8bd05fd9bec79d643edb503634b8b5238c67c77ddd8d2c3220406c08b1e6197e8aff02c709e353bc4ce9353a6709837b81ca443660250d94e73c00d66f451

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57c4c7.tmp

Filesize
333KB

MD5
56a2bcecbd3cddd6f4a35361bf4920d6

SHA1
992e63be423f0e61093ba183f49fc0cbec790488

SHA256
5fcfac18758a12e0e717a5189f379922a32b5ac12f26491e638d70b54ae1dcab

SHA512
473cbdf760242db1f0f1d0c27046c0564998f2bf931ad03feb28af3c7bd253d00e6f0836dadf37f29e0db4171eb64e6a15ed4cb9a9d28b48fb0aab601573f551

Download Submit
memory/2584-12-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-11-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-13-0x0000000004790000-0x00000000047A0000-memory.dmp

Filesize
64KB

Download
memory/2584-14-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-16-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-17-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-15-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-18-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-21-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-22-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-23-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-25-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-26-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-27-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-24-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-28-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-29-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/2584-30-0x0000000061080000-0x0000000061119000-memory.dmp

Filesize
612KB

Download