Analysis
-
max time kernel
149s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/09/2024, 11:16
General
-
Target
2024-09-21_eac8781453cf8ebbb83913c377f44cb2_goldeneye.exe
-
Size
192KB
-
MD5
eac8781453cf8ebbb83913c377f44cb2
-
SHA1
f3bfac5137ab017fe49d19c79fe4a74bad8c10cf
-
SHA256
a4658b1438b78a179f8a3de23000048a874801b51d7bec84f0009f2d51149ff6
-
SHA512
2da77603029dac157fc6080de058f8044bb40c4a343b825426c539c835bb4c22aff96ee636dbbe2dd1c7ca1a6fa15e6cc4a68b41077ec9ab4de0cd2d228709b8
-
SSDEEP
1536:1EGh0oll15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oll1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_eac8781453cf8ebbb83913c377f44cb2_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_eac8781453cf8ebbb83913c377f44cb2_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B85F6A4E-B6E8-4f7e-918D-0FA3F4BECA4F}.exeC:\Windows\{B85F6A4E-B6E8-4f7e-918D-0FA3F4BECA4F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B9519E50-AFA2-4521-B24E-E2F266E75511}.exeC:\Windows\{B9519E50-AFA2-4521-B24E-E2F266E75511}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE3C4484-E6AA-4542-804B-30E9F3C122E0}.exeC:\Windows\{DE3C4484-E6AA-4542-804B-30E9F3C122E0}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB25ECC1-3C69-4ea7-9C37-012C1A4BB314}.exeC:\Windows\{FB25ECC1-3C69-4ea7-9C37-012C1A4BB314}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BC9A79C0-CF00-413e-B051-55B8FE1746B3}.exeC:\Windows\{BC9A79C0-CF00-413e-B051-55B8FE1746B3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E643E2E2-64D7-4e6e-A5F7-B800ADD72E27}.exeC:\Windows\{E643E2E2-64D7-4e6e-A5F7-B800ADD72E27}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AAA57840-EBA6-4ef3-AF5D-E3C62D4E8A3C}.exeC:\Windows\{AAA57840-EBA6-4ef3-AF5D-E3C62D4E8A3C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C21B32D7-38E4-4d68-8097-F52983508B8D}.exeC:\Windows\{C21B32D7-38E4-4d68-8097-F52983508B8D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B1473B75-8FF0-422f-8914-8E2B0791CB11}.exeC:\Windows\{B1473B75-8FF0-422f-8914-8E2B0791CB11}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{683B8A1C-9359-4bfd-A0B7-115EB8E000D1}.exeC:\Windows\{683B8A1C-9359-4bfd-A0B7-115EB8E000D1}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8AB9C67E-A8BC-4caf-AF34-236CF690FAF1}.exeC:\Windows\{8AB9C67E-A8BC-4caf-AF34-236CF690FAF1}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{5F0D1BC1-0E5F-4f4b-8953-FEA307C54815}.exeC:\Windows\{5F0D1BC1-0E5F-4f4b-8953-FEA307C54815}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8AB9C~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{683B8~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1473~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C21B3~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AAA57~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E643E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BC9A7~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB25E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE3C4~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9519~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B85F6~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD57e5bb73aba9aece6d95d264c2c0c7d13
SHA101a12d2f786ce19120b26b7f70deeadf8995160f
SHA256eb3b6bbc6e35bb923c1ec0713965a981e2900d47e09c14c1d596208c36babb15
SHA512884476040cd112b31acca840f78b74acdd9370fd2b3c03d1031e8974fdc2a0b4f83f2001efe357a82f4e31febad25c43bbd3bbe98f35da65a06d8db8008c0ee8
-
Filesize
192KB
MD552d351e0f5db77ab1d49ea8d387e9617
SHA1bfab12d4fa285aecd9fbe50bcfbdb1c08b69df3d
SHA2569832310dca92c14a7987f8badcc65c5496e7b3eda8fe79472be8b46c1c5bbbd8
SHA512912623366c90c8bf36251a2378085ab72e1907b2775bdd311500779eabc98a5f890d3d647965b7d758aa8f35f9ef9a514df74398d02fa3b0db7963bc590fd31b
-
Filesize
192KB
MD52cda91f362313119fd00df4cb77887c7
SHA144e07a39a7b37396546ddd7861dc3c385fb17ff4
SHA2565e951a27fd59459ff90a3c3663811e5b123c169d444279607e1a499d6cab3024
SHA5127938cec151d3ea34d3f4c1a0a2f55e57628e2da22bcfc1eaa2c318e8f84a65575d0dc45ad9256ebf40f01d104a27d8dcbd344fbe65b6d01f212dd23c2ea00a26
-
Filesize
192KB
MD5e1d16d28c1b786c59ea79dbdda91e78d
SHA14abba1c60cc55cc5e3131256d3775819346e9799
SHA256859dfe73c18faf8c9964b439a6b9dc74def9b48c0f1ca96ca644cfbe4d60edd2
SHA512f6cca0aa2a5bca43cf31fde027214a472b7622fa14ca0dc792ebef6c8671186b1d56a9cbaf5d6820be7c7369789c1182f7f6aef7a243d183f562aa3794fc2b02
-
Filesize
192KB
MD5174428a23c560c9155f17736000809b0
SHA15bc0ba611af84f12dafd38efba535501f055cae4
SHA2563d3e9b399c927bdd0b46b5e0588f158ed2ed81282e4199e69987168d1ef91d21
SHA512078d2bb8ae6a9d13c0da469b6576a9fd405e2f4568b475eed7e6e0e48521690413a2ee5904b37ebbe9906d4142a1274bc38e87be1eba4594beb124057b58c68a
-
Filesize
192KB
MD52c6be52c7388ddf718ec35f3ae9912e7
SHA1eedbcaf1eaba3f022a145b091e8a08c387769f83
SHA2567eb57fd8c075ea64cc69d7dceac1a06e67064d8af52f89a45c7be02fd3d786c4
SHA512060c44f789faeba475b32a208dfee29188078571b37fc5410e77201ae9968b72f61674ae50c60418d5003983d7eea1eb8de600a7b0b84b9e705c0340c22f3215
-
Filesize
192KB
MD552c01976d0a797d13a4643170c4c31ab
SHA11d65d2a848d612b730f12b8a3046f0aabf009d59
SHA2567f87d56eb4c6e41fbfd6b3497fd9ad0370b5937e80cb7bf929926b3fa6402915
SHA512cab01813a3829c22aed720a2c592a7060bf46415957b27db42508d2b40501d3d54ae434f9939e14429e259bae9335a3ca6551ded47195a01dabcaa0207a76e4d
-
Filesize
192KB
MD505af3258e602273d09e4d1b551ecf6a0
SHA18aaeb08d8e58eb50404f5cc98bfb2a3e421e558c
SHA25611d7a2b12dc5804191eb2a8217a87a7db2caaafe335eeeacc766da0ff074553d
SHA51247d9996c652a2055e2258d2450bdc3eab3cdd571856c5555f781251471507bfa63f6a8900cb5219ed7779a30f279c824e740ebd8065b4c9a77439afb24bfb13f
-
Filesize
192KB
MD5e8e25a4b03846bf3cea91f61a2921706
SHA11a38e2f767de246ea309d85b839d8d9466df26e1
SHA256906fb0124c1a94f1368b15ae3aaacfb63e6287661770bd402a4a9389a263946a
SHA512e0498d69f578e8e8c8e3989f7cd29b26916292420bb0e3ed5d299c90b1722c845b68dc45b9285212365067bcc65bac121922aec3d6b6469850854c1c46330d9d
-
Filesize
192KB
MD51913cdee2baf2f18e4e9e27759d42255
SHA1bfbf89550e13a57d16d4d8aedaa1448d2815076b
SHA25612cd681ec5c480d9139d86876d8e9d86e153d0cae80cedf8d1df3a4fba3cd27f
SHA512531d7990dd810d78c85233d65b5f36448b21f9f335173fb4f4c459f1aac3e0cd921c5d5ad7f2fd8dbf7a9df3308ad89381e09818bbb7df6d45a984760b515295
-
Filesize
192KB
MD5cd25f4ec43bda44399f53d5750ae1d4b
SHA1bed31be43dc055d66cdcafebd527d80d87d34d17
SHA25606a1a8ff9e307f99a44e1fe73f47bb187bc3e4a072b08d8c532d03c6699d0b33
SHA5127e1b725a0f9f3507b0e761e8baa7f783414b5f516052665ef461da674d337bf8457c2fd482ad2a1e9f418cbd96ed2e2ef5fcbeded4a63bb3e4401fd3f89993b7
-
Filesize
192KB
MD51d29df136590a3adebd4d30968c8f618
SHA1e21660d076df68262484c30bcfe36da6e9ff1449
SHA2564171f2bab4aeff2c4847b5fdc9fb493a9ea0197fda8c67941493b946165c9eb3
SHA5122e96982ffd9ce01c3082875875285a30ecfe66cecb67dc9f2cb10828bd956289fbae8902c7dca490f69d0bd35bc0885e20f103091c05daf1de77c8c36f3d25ba