Analysis
-
max time kernel
119s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30/09/2024, 05:38
General
-
Target
4084d2b924cf2e9725789053a93c5369f16718ee7df5982e7bc73aa2d825148eN.exe
-
Size
501KB
-
MD5
206f635a153c888b36ee21db9f01c780
-
SHA1
779b985c59813db2dd16fc5578cccf32e66d3e75
-
SHA256
4084d2b924cf2e9725789053a93c5369f16718ee7df5982e7bc73aa2d825148e
-
SHA512
572f02e587c447bb2a3300385ffd62db2bd3e00c67806852a40a4c2047296afe30b65f5a1f625b7277b333f3a23f5d3c687dc7df6bd8c30fa7e0ee69701b3813
-
SSDEEP
12288:DLPkCDt1EG2XVekhdeT1PuAl60OrkP8zIx7O9vouvE7sGh8kT:DLPkQ1bqA91ljskF7OzwsGh8kT
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\4084d2b924cf2e9725789053a93c5369f16718ee7df5982e7bc73aa2d825148eN.exe"C:\Users\Admin\AppData\Local\Temp\4084d2b924cf2e9725789053a93c5369f16718ee7df5982e7bc73aa2d825148eN.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ipcoHost\rasdedit.exe"C:\Users\Admin\AppData\Roaming\ipcoHost"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~A3D1.tmp3480 513032 1776 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 6243⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\fingdiag.exeC:\Windows\SysWOW64\fingdiag.exe -s1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2044 -ip 20441⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
501KB
MD5261b7f30c88b6cd3fbdc4bc5796e7675
SHA15266653c51888951bd6377ee0f5f1470dfc95832
SHA25678ec774d8bb85c2b3278a7c5967c09af4f394b791f0bfecce59c6032a14d9930
SHA5129bb312f31096541f8b7bbf9a3ef693592550fdba4e82fc41c5b9a95f19f03f931f4527c9b043033693a03f7e088593681bd02af26009835eaa7d57c8f289e2c5
-
Filesize
540KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
540KB
-
Filesize
24KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
52KB
-
Filesize
24KB
-
Filesize
564KB
-
Filesize
564KB