Overview

overview

10

Static

static

10

1727246228...ed.exe

windows7-x64

3

1727246228...ed.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2024, 06:38 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe

  • Size

    32KB

  • MD5

    145ec63fa85b1dd8c0a4c528a3b15cc6

  • SHA1

    8343262ce152b88508474457db596b5035586155

  • SHA256

    ec7a3cad963d387d0eb81abd5fe7db17c6aa634ac30ff8485447eec2b5cd3dcb

  • SHA512

    d5f85626316ba7f812278da24461c9efcfee7fa1ae563b2595eb59c01f17893999eea11171d7818aa64022d7fe2d629e95fccd4a169c9cbab47370c508a40530

  • SSDEEP

    384:u0bUe5XB4e0XOOSSGgFS6Z/73xWTStTUFQqz9UtObbi:/T9BuNSgS6BNJCbi

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    "C:\Users\Admin\AppData\Local\Temp\1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:3304

Network

  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    69.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    69.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    notificadoresrma.duckdns.org
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    Remote address:
    8.8.8.8:53
    Request
    notificadoresrma.duckdns.org
    IN A
    Response
    notificadoresrma.duckdns.org
    IN A
    46.246.14.12
  • flag-us
    DNS
    notificadoresrma.duckdns.org
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    Remote address:
    8.8.8.8:53
    Request
    notificadoresrma.duckdns.org
    IN A
    Response
    notificadoresrma.duckdns.org
    IN A
    46.246.14.12
  • flag-us
    DNS
    notificadoresrma.duckdns.org
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    Remote address:
    8.8.8.8:53
    Request
    notificadoresrma.duckdns.org
    IN A
    Response
    notificadoresrma.duckdns.org
    IN A
    46.246.14.12
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    notificadoresrma.duckdns.org
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    Remote address:
    8.8.8.8:53
    Request
    notificadoresrma.duckdns.org
    IN A
    Response
    notificadoresrma.duckdns.org
    IN A
    46.246.14.12
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    notificadoresrma.duckdns.org
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    Remote address:
    8.8.8.8:53
    Request
    notificadoresrma.duckdns.org
    IN A
    Response
    notificadoresrma.duckdns.org
    IN A
    46.246.14.12
  • 46.246.14.12:2054
    notificadoresrma.duckdns.org
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    260 B
     5
  • 46.246.14.12:2054
    notificadoresrma.duckdns.org
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    260 B
     5
  • 46.246.14.12:2054
    notificadoresrma.duckdns.org
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    260 B
     5
  • 46.246.14.12:2054
    notificadoresrma.duckdns.org
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    260 B
     5
  • 46.246.14.12:2054
    notificadoresrma.duckdns.org
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    260 B
     5
  • 46.246.14.12:2054
    notificadoresrma.duckdns.org
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    260 B
     5
  • 46.246.14.12:2054
    notificadoresrma.duckdns.org
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    104 B
     2
  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    69.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    69.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    notificadoresrma.duckdns.org
    dns
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    222 B
     270 B
     3
    3

    DNS Request

    notificadoresrma.duckdns.org

    DNS Request

    notificadoresrma.duckdns.org

    DNS Request

    notificadoresrma.duckdns.org

    DNS Response

    46.246.14.12

    DNS Response

    46.246.14.12

    DNS Response

    46.246.14.12

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    notificadoresrma.duckdns.org
    dns
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    74 B
     90 B
     1
    1

    DNS Request

    notificadoresrma.duckdns.org

    DNS Response

    46.246.14.12

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    30.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    notificadoresrma.duckdns.org
    dns
    1727246228bf52474d96d0c91d76eecd39cfb06284f20ad0f3e787fb96b50f595788ca18c5809.dat-decoded.exe
    74 B
     90 B
     1
    1

    DNS Request

    notificadoresrma.duckdns.org

    DNS Response

    46.246.14.12

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3304-0-0x0000000074AB2000-0x0000000074AB3000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3304-1-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3304-2-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3304-3-0x0000000074AB2000-0x0000000074AB3000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3304-4-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3304-5-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.