Analysis

  • max time kernel
    97s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 01:32 UTC

General

  • Target

    b1b74ff5c67cfdc16f1cb30db9b885046c4c5d71af575a2d3de4a79918c1ce89.exe

  • Size

    1.7MB

  • MD5

    be852e807a629c65f1b41617c8348f2c

  • SHA1

    05d64861185f84e071d8c98eaf7ea86d22bd921d

  • SHA256

    b1b74ff5c67cfdc16f1cb30db9b885046c4c5d71af575a2d3de4a79918c1ce89

  • SHA512

    116f8da7c3c1bd69c3ff600348c35f4ad181f1c47a093d7224118c26c8d9ac03cba220dddb9d3fb7fdbf7aab52ff78fd9f064956007d6480ddb4d6ea38e6cea8

  • SSDEEP

    49152:fU/FMktb3x+muH5i44fTco84Ws5zwgio:cdMEb3x+mulIoh4H1i

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3480
      • C:\Users\Admin\AppData\Local\Temp\b1b74ff5c67cfdc16f1cb30db9b885046c4c5d71af575a2d3de4a79918c1ce89.exe
        "C:\Users\Admin\AppData\Local\Temp\b1b74ff5c67cfdc16f1cb30db9b885046c4c5d71af575a2d3de4a79918c1ce89.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5032
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4292

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      4.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      4.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      86.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      86.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      107.12.20.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      107.12.20.2.in-addr.arpa
      IN PTR
      Response
      107.12.20.2.in-addr.arpa
      IN PTR
      a2-20-12-107deploystaticakamaitechnologiescom
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.56.20.217.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.56.20.217.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      11.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.227.111.52.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
      90 B
      1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
      159 B
      1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      4.159.190.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      4.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      97.17.167.52.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      97.17.167.52.in-addr.arpa

    • 8.8.8.8:53
      86.23.85.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      86.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      107.12.20.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      107.12.20.2.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      43.56.20.217.in-addr.arpa
      dns
      71 B
      131 B
      1
      1

      DNS Request

      43.56.20.217.in-addr.arpa

    • 8.8.8.8:53
      11.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      11.227.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4292-1095-0x0000000075230000-0x00000000759E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4292-1097-0x0000000075230000-0x00000000759E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4292-1094-0x0000000004D90000-0x0000000004D98000-memory.dmp

      Filesize

      32KB

    • memory/4292-1092-0x0000000000400000-0x00000000004D0000-memory.dmp

      Filesize

      832KB

    • memory/4292-1096-0x0000000004DB0000-0x0000000004E92000-memory.dmp

      Filesize

      904KB

    • memory/4292-3976-0x0000000075230000-0x00000000759E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4292-3974-0x0000000004F70000-0x0000000004FE2000-memory.dmp

      Filesize

      456KB

    • memory/5032-26-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-16-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-12-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-54-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-66-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-64-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-62-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-60-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-58-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-56-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-50-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-49-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-44-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-42-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-40-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-38-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-34-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-32-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-28-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-2-0x0000000005200000-0x0000000005392000-memory.dmp

      Filesize

      1.6MB

    • memory/5032-24-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-20-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-18-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-4-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-10-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-8-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-6-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-52-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-46-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-36-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-30-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-23-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-14-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-3-0x0000000005200000-0x000000000538C000-memory.dmp

      Filesize

      1.5MB

    • memory/5032-1077-0x0000000075230000-0x00000000759E0000-memory.dmp

      Filesize

      7.7MB

    • memory/5032-1078-0x0000000075230000-0x00000000759E0000-memory.dmp

      Filesize

      7.7MB

    • memory/5032-1079-0x0000000005390000-0x000000000549C000-memory.dmp

      Filesize

      1.0MB

    • memory/5032-1080-0x00000000054A0000-0x00000000054EC000-memory.dmp

      Filesize

      304KB

    • memory/5032-1082-0x0000000005800000-0x0000000005866000-memory.dmp

      Filesize

      408KB

    • memory/5032-1081-0x0000000005720000-0x00000000057B2000-memory.dmp

      Filesize

      584KB

    • memory/5032-1083-0x0000000005E20000-0x00000000063C4000-memory.dmp

      Filesize

      5.6MB

    • memory/5032-1087-0x0000000075230000-0x00000000759E0000-memory.dmp

      Filesize

      7.7MB

    • memory/5032-1088-0x0000000075230000-0x00000000759E0000-memory.dmp

      Filesize

      7.7MB

    • memory/5032-1-0x0000000000610000-0x00000000007C4000-memory.dmp

      Filesize

      1.7MB

    • memory/5032-0-0x000000007523E000-0x000000007523F000-memory.dmp

      Filesize

      4KB

    • memory/5032-1089-0x0000000005D50000-0x0000000005DA4000-memory.dmp

      Filesize

      336KB

    • memory/5032-1093-0x0000000075230000-0x00000000759E0000-memory.dmp

      Filesize

      7.7MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.