Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 19:39
General
-
Target
c1f12dc3c0fb09f65783075b08c530090e19a143b545d1b4b06ce2a17e9021d5.exe
-
Size
9.1MB
-
MD5
9e75c8d731ee3a6dd9a83209044f2cad
-
SHA1
eec3655f162fa2202eca56041631943d3de1c006
-
SHA256
c1f12dc3c0fb09f65783075b08c530090e19a143b545d1b4b06ce2a17e9021d5
-
SHA512
faa51b04fd9cc39af2a79ed6ea08d7370a873858b4dea9553258acb31d2bb56abdeaf51a53428b3a616c2ca42776c849482ad711ffa9ff1958cf1698d1117444
-
SSDEEP
196608:1by4htFEGGC0sxRNw+4DAT1sfGpmpZyZkpUvWkg+6yrjvfdS9+5Tq3YsF8:1by4hnE5C0Ua+4Dy1XWru7gsfVruNF8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1f12dc3c0fb09f65783075b08c530090e19a143b545d1b4b06ce2a17e9021d5.exe"C:\Users\Admin\AppData\Local\Temp\c1f12dc3c0fb09f65783075b08c530090e19a143b545d1b4b06ce2a17e9021d5.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Ѫɷ¹¥ËÙ΢¶Ë\c1f12dc3c0fb09f65783075b08c530090e19a143b545d1b4b06ce2a17e9021d5.exeC:\Ѫɷ¹¥ËÙ΢¶Ë\c1f12dc3c0fb09f65783075b08c530090e19a143b545d1b4b06ce2a17e9021d5.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5300ce7bc3bbd7d89076570731cde8ed5
SHA11deb0542437947901c5bb7d2724102661df60374
SHA2562870f0bd2f17f804ef348e6fef15cad9f4b11710aee31db5c06c9ea1411c79bc
SHA512a7b55d7ba45dcebf9e562c66a2dd8b4cb3904029a6b807425d95c4e6f2d2780ce6dd20dbd1dff6ad1fc25cb5d4ea790311406b32ab1ee0ff05a06812a6452dd6
-
Filesize
9.1MB
MD59e75c8d731ee3a6dd9a83209044f2cad
SHA1eec3655f162fa2202eca56041631943d3de1c006
SHA256c1f12dc3c0fb09f65783075b08c530090e19a143b545d1b4b06ce2a17e9021d5
SHA512faa51b04fd9cc39af2a79ed6ea08d7370a873858b4dea9553258acb31d2bb56abdeaf51a53428b3a616c2ca42776c849482ad711ffa9ff1958cf1698d1117444
-
Filesize
9.3MB
-
Filesize
4KB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
64KB
-
Filesize
9.3MB
-
Filesize
64KB
-
Filesize
9.3MB
-
Filesize
9.3MB