Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 02:35
General
-
Target
d582110cd8a31d867e1a1eada4fb726acbbf960bed0aafeec854e455bc53403f.exe
-
Size
146KB
-
MD5
ef8b996e4d7e84c179f8268f3d686195
-
SHA1
07057ff4fd122bca513bbce0cbaa1174d50caf01
-
SHA256
d582110cd8a31d867e1a1eada4fb726acbbf960bed0aafeec854e455bc53403f
-
SHA512
6c434febdbf2e57328a118d249d3a8ed736749671b605c9baabecbcafc4040ab10f0c0ce94f6f2551286fc213b4f88a6079271ff4971f524a36211b25f70b90b
-
SSDEEP
3072:gqJogYkcSNm9V7DXW5I4KNGHsOqhNDvtdT:gq2kc4m9tDXW5fdqh
Malware Config
Signatures
-
Renames multiple (361) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d582110cd8a31d867e1a1eada4fb726acbbf960bed0aafeec854e455bc53403f.exe"C:\Users\Admin\AppData\Local\Temp\d582110cd8a31d867e1a1eada4fb726acbbf960bed0aafeec854e455bc53403f.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\C523.tmp"C:\ProgramData\C523.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C523.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD53191fac3d4e940bb88bf2e8b2b268a17
SHA1b7230a5e15a2f25c23aa1592261d68b2cf82a220
SHA256669a96eec2592a5491f38a43d9ad436ec5bfc771168be04ade7a9a664056dce7
SHA512a74814002ee36a27b65479e1cb97fb16f6570462a0bffa06d63f75b7040825b26b9e2ecc470c794f2b4d2107ccd8ca8525063ff9a49c47bf7158a748c368a181
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD59dea6c55b7ef53696143efaa47906f0e
SHA13d88f5c5e659141cd1a61a863ba0b980a183502c
SHA2562f85001b8015d864b0e4fab26ffd79e9b551f8bffa620a62d66c88a5d4bf73cf
SHA5129a49230506c18e5d0bf32d6cb80041560b5ada0e99024fbcb54a0447acf286019c93f2e95b04af7bb883e5765f9b08d47d5625b4049fe2aaa79b44b9d423ab13
-
Filesize
638B
MD5e5bc1b8f423f3cce04388bfbe53d93ff
SHA154e173bb949842e15150102631a2fd8c7fc0d967
SHA2567c750178e9525b4eef587eed36c7040a4806207909e4463a56f33073081b7de5
SHA512aa720ad06776f38ce63d67b743ee019bef1130874a52d7825559e559a056e2ed5c543290a1c13e6ea733204791865ba17f9d4b1d0650e64db1f89af0da7b693f
-
Filesize
129B
MD5e31d6b68733a86cfa84ae95c5030bf3c
SHA1bc101547eba2d0fc8d7a1e330cb6a7d25615b5be
SHA256aeca0285ae36af4398939822c8c25d4e661aeddb4488819de9c4fd56c69d1073
SHA5125ed5f4abb85c6fac00b77bbe0823e2ac12499083b654a7f05895a8dfc35f3d5f10c63fd192e8555e46ad63a0fa710a3817bd34c8bfe733e44bcf37922e0b1cf6
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB