Overview

overview

10

Static

static

3

fc2da056e7...6N.exe

windows7-x64

10

fc2da056e7...6N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 12:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fc2da056e7e5fe182e67e2010371267d7296b8eabdfd3e1abd24c097896de9a6N.exe

  • Size

    31KB

  • MD5

    b48cc22f202d4bff54fe2b13a625a7e0

  • SHA1

    9d649e11f8ed5e4c97fe8b4f5ea0928fbe8bfb59

  • SHA256

    fc2da056e7e5fe182e67e2010371267d7296b8eabdfd3e1abd24c097896de9a6

  • SHA512

    b01ee54b70198aef6d60d52c9000444ba25a19297eb630c10a2b4d8690f3e26e6d58bce7f8c1302ec207030e9d717e5f4236040590e2946789104de72c6c4dd0

  • SSDEEP

    768:r25KLZ/vbDEj7RzyCxHKW6wVmuHXJHdzTC/Wc8HEzHvc:r25SZbDEj7RmCxL6wVBpGpRTvc

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc2da056e7e5fe182e67e2010371267d7296b8eabdfd3e1abd24c097896de9a6N.exe
    "C:\Users\Admin\AppData\Local\Temp\fc2da056e7e5fe182e67e2010371267d7296b8eabdfd3e1abd24c097896de9a6N.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\Admin.exe
    Filesize

    31KB

    MD5

    3b8d6d4e2ac0c2264069a6b06e53a6e5

    SHA1

    db4645258785a68793d4814adc4bbefcda1cf6da

    SHA256

    4656949ac0dee5b71ec85a24c4194f14a1eb8f3416f01b6a35f673d0e3bbe9cb

    SHA512

    39ef401038ba128b69b3a7314eaf65265b45e009075fdd1372bb56e8c0563b05cdfc36ccb7d6a744c3449eca10f34072120c1133fc1833ec586e4441d5be3759

    Download Submit

  • memory/2688-13-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2776-0-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download