Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 04:09
General
-
Target
2024-09-19_d6db1960a12e825d74675e71f9fcff5e_goldeneye.exe
-
Size
197KB
-
MD5
d6db1960a12e825d74675e71f9fcff5e
-
SHA1
756bb2e04cbfb3cdb7b52595361800f17d631583
-
SHA256
373ab475e1f0754f412f6454704be63ab90713823b40c17373c36886b789dc0f
-
SHA512
ae2847330ad3163e4a648b1252d69bce845bd4426fccb0d7b7795f22622a2faabe20883393df5d21de6010f96939aa7c7587c028fc28335f120db8f0aa28e6a5
-
SSDEEP
3072:jEGh0oll+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGvlEeKcAEca
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_d6db1960a12e825d74675e71f9fcff5e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_d6db1960a12e825d74675e71f9fcff5e_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A6598ACC-7502-4373-8D2F-FD3346148BE5}.exeC:\Windows\{A6598ACC-7502-4373-8D2F-FD3346148BE5}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC4E6608-4BC2-4fac-9281-8B868DE2D304}.exeC:\Windows\{CC4E6608-4BC2-4fac-9281-8B868DE2D304}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03247A48-53BE-4f9d-B3F4-DFD3DBD5B81D}.exeC:\Windows\{03247A48-53BE-4f9d-B3F4-DFD3DBD5B81D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C0904BA5-C903-4bee-A7EC-C685F04A8151}.exeC:\Windows\{C0904BA5-C903-4bee-A7EC-C685F04A8151}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C3452E6-D5B9-4f80-A4FB-6FEA14084CA3}.exeC:\Windows\{4C3452E6-D5B9-4f80-A4FB-6FEA14084CA3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A2C28C3-C577-4307-A101-1E7E59A3C446}.exeC:\Windows\{0A2C28C3-C577-4307-A101-1E7E59A3C446}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{72B7811B-C95D-4295-B6CE-7049DCB89CF6}.exeC:\Windows\{72B7811B-C95D-4295-B6CE-7049DCB89CF6}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CECE8C6D-2B75-449e-B7C6-FE12F0F5D359}.exeC:\Windows\{CECE8C6D-2B75-449e-B7C6-FE12F0F5D359}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD09711F-5251-48e4-97DD-6464291EA68F}.exeC:\Windows\{AD09711F-5251-48e4-97DD-6464291EA68F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D51975ED-945B-4622-B4EA-77A3720DEA6D}.exeC:\Windows\{D51975ED-945B-4622-B4EA-77A3720DEA6D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E007C71D-FF6E-41ca-8ED4-8C41FD2D2B08}.exeC:\Windows\{E007C71D-FF6E-41ca-8ED4-8C41FD2D2B08}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{59D78DFC-D33F-45c5-9AD2-434D91A200EF}.exeC:\Windows\{59D78DFC-D33F-45c5-9AD2-434D91A200EF}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E007C~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5197~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD097~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CECE8~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72B78~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A2C2~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C345~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C0904~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03247~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC4E6~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6598~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5192fc1ee0cbf8e17b5193f36787f70be
SHA1288908ebeb14fdb299817ce03afad471652ad9e1
SHA2566ddbc1f5df526885f3a8b56942489bd0cfd7f90e37debc706db0b45e3585686c
SHA5128263a64cbc654dd48295f28fc0234e6588d8be4f977352d8e37eadd3f58f821e1a71fb5ae7638981be6a002baea40dbd5ec70152d88d976bf66b0f0e9514c18a
-
Filesize
197KB
MD56a13cf85dd4c18e2c2db12130a1cb30a
SHA1e669047ea95c901ce375439c0698d0738c8fc621
SHA256ad63ce1115b31b23afb050e67e43f4d5223e39a628f815db12b81300edd77e83
SHA512fbf587111e60998b09a4d41ed12a15ff2c81b029a2041e6828e67f9d2f3653b078751c4b3adbf9bc0c1872e872b21b8e8429f6dde360593e7c409dc1f97a5142
-
Filesize
197KB
MD596eddbc6d2f47c0aa82dbb5e6671aea2
SHA15445b94206fca69df0e02d3d193b652d4fbfad10
SHA256b6c5eba441602c777ba794c1387abd2a60c2205f5f5c87d6c86be7537463aaf3
SHA51227b4c3d11dd4f1f3c765455e25fab21ab212283434df3a79033da451274ed722daee829b531c6c0cf959044bf4c14888b438a9ec49a837686673fa56d593bc11
-
Filesize
197KB
MD5555b64e0af759b0697108c2255bd1fc6
SHA149de145637677bc8df65add144e98b524606427c
SHA2561b6bd35ff0300b00c0e5ca815b55aeb4f2d997bd1cfcdd82c3971a87e43f7664
SHA512545ae68e0c063daa61f09c1070ee0eb506b3d6fed805de7da2493f9bd898b69d364cf8b859c2ad5bb29abe9e88d8c5b3acbbe2f846201f97063459662211e60c
-
Filesize
197KB
MD500daadb17b6ec9ecda468965367373f1
SHA1cacc19c8739d067006de8c719fb9b8c07ffe97c5
SHA256b6aec6ccdc4672730d010cd0a308767642bb0f6732422d8d780bf6353cd5dc8c
SHA512a3a46b17b2f48da034631794360ed28872d8b69de01b17c116168a549b734a461f6a18ffa350eb75af47405925f8357ca118de8525421d7936934afb6b6d5e61
-
Filesize
197KB
MD5e6b111c933d0330895737f7b6b6d36ba
SHA187b03c3afb0b51dd6c24e29ca7d7c3866b9ec785
SHA256a5ef1cf307e4a3382b663bdbc1fbd20abde408ca3bbe829f477c47a5e4b0b1f3
SHA512dd4d587aab9261ced8f53904cd776087ee7189d310d94737b43a6a242ba7d5a4ec4b92fbb755ffd50065079580d6c552f0d09a333bef87b49a48dec798997911
-
Filesize
197KB
MD5b3f3f4de260a032bedce597ce83ce3e9
SHA1d73a78ff49b0d1901926f68c86d28623f2c4c7fc
SHA25615e3dd6eed1cc2125e38a5e06698a101bcd1e7cdd976cff042b440e85ba92e1e
SHA51201ad00180d8d7ee77f83ba44fe21000c30f05c5bf29ebbe68eaf161ef3e558fdcd4f12fd9b5093b5f6935fcc70bfc3e08b28c63844b61f45453598beb91290ba
-
Filesize
197KB
MD57d30db3634e677eaf2c20c50222881cc
SHA125d26011b280ba97cf6165558cb764a7f355b8d6
SHA256113c22ce3f84650a30c06b7640dc044da4314705a3a05b79a44c3166535dac9e
SHA512d62f0227dd9e2bec73498df4dc7b79ee2aa55e7aea5e88b37f490dfccc091321cf6d5fe40f63757d2c63b0293356a4eb78646c401c8e3fb0f945657471c10d64
-
Filesize
197KB
MD5940f8b9c2aba59c4d348664d5074af70
SHA113c054c3e4be3ba602a21b9aa2e89a9208313035
SHA2564e6de7daf2bfea96fe98aa155c1b8ecb0f5dccd44a2c4be70004c1e26f71e382
SHA5124f73feb590313db53230bd7d7cfb4bc28e7ece9438fb187ab0061fc702fdd4ddd69d2e018ea7be21073c1261f4343a8fb40b8baba68edc122755ec1fa11c1c11
-
Filesize
197KB
MD510bf3f9bc5632c70fc33ac532696c5d5
SHA197e5080bd799a7f38ab6cee6bda259812199f2ed
SHA256c113122b21f29a4ec1f143e4ed2a2c68471c448c4896a7eb62e9d897924b811e
SHA5120c5f5cb7e6367fadf50eed94fe9bf8e397c84e9525c1d68e93318b4420e4ba2391d5edb151071eb4b6c21473aac4414996726c383f94fd72af1188ac111532a9
-
Filesize
197KB
MD59839a7efd4b0701cbc3bd4893aa909a9
SHA1fe26fdd512c6eee22054d3f3f3b394b26227a23d
SHA256b96d12ce39c6689a72891771b522545ade3c2bcd11ee38a53efc87d7ec0fc9f9
SHA512dc164055915987b2fb2c24e35813f0882783c97ccd1ccc2af61675f27dbd9ddf94c035ec8fcfeedd3cc19220dd4ef0b49d12bd9779a188a0ba6247c1ed460476
-
Filesize
197KB
MD5d5481f977af6d5dc716c782a478726a1
SHA1753ea286f3f97a0a235ad8e43300b3c68d1848ee
SHA25639a2888725e8c6b5f3bafaa991f5ba7b9c36c89f271dd8eaaebb3940955a4d1b
SHA5122b2f0d57167624dce899f277b653b431e10b86dfb85e4e3713b4d8579f2cededd122ae8ee8d40585152c7d3f3dd681e952a1507d4614a11397d143a84c19ad94