Analysis

  • max time kernel
    178s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2024, 14:59

General

  • Target

    f4ec5e3d1c8ba823ffe99a85704db2de.exe

  • Size

    379KB

  • MD5

    f4ec5e3d1c8ba823ffe99a85704db2de

  • SHA1

    beab1d4c708e247acb025da51e8af82bd2c0cebe

  • SHA256

    b5e0c038f3f6f225b402354a607411cf0e41317c4dda0f85f67a591ecc2d48d7

  • SHA512

    b6194b6e9ce21019ddd82431050ef4b9fd91501f6a603e8fb6ea12ae5dfb7e7a70b712c01857ebbbf8704c70babd581c6f9d905382f382608131a5d5a8fe454e

  • SSDEEP

    384:H+b0ZIrceK5eDKe5Teuek41UQFn0FWkorqVsiEsbTGETNkrMX4mT6h8CfskRpwKH:RZRiKFnQoWTxgPC3Yi3iPmbLDC

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3576
      • C:\Users\Admin\AppData\Local\Temp\f4ec5e3d1c8ba823ffe99a85704db2de.exe
        "C:\Users\Admin\AppData\Local\Temp\f4ec5e3d1c8ba823ffe99a85704db2de.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4540
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3252

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\xasds\logs.dat

      Filesize

      144B

      MD5

      9b688ed61fe885a927fd6ccd1c5257ff

      SHA1

      d5059a9aa9f216b452a4a57157aebf08e8555203

      SHA256

      1fbea56703a183136e690de73ee4ce2e30ac7cb343d5e36f26db1cb3d3b22fc4

      SHA512

      093104eaa7d32eafd233ff45f457cb7c62ee6026b7057ca2d2ca89778da08435976d78cda6232ade628498ad9f63562c906b72af8e80ac13490f70b427bdcf07

    • memory/4540-29-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-61-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-3-0x0000000005790000-0x00000000058AE000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-17-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-21-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-51-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-55-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-67-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-65-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-27-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-0-0x000000007511E000-0x000000007511F000-memory.dmp

      Filesize

      4KB

    • memory/4540-59-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-57-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-53-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-49-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-47-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-45-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-43-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-41-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-39-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-37-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-35-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-2-0x0000000075110000-0x00000000758C0000-memory.dmp

      Filesize

      7.7MB

    • memory/4540-33-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-63-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-25-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-23-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-19-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-15-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-13-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-11-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-7-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-5-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-31-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-9-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-4-0x0000000005790000-0x00000000058A8000-memory.dmp

      Filesize

      1.1MB

    • memory/4540-1078-0x0000000075110000-0x00000000758C0000-memory.dmp

      Filesize

      7.7MB

    • memory/4540-1079-0x0000000005C30000-0x0000000005CC8000-memory.dmp

      Filesize

      608KB

    • memory/4540-1080-0x0000000005CD0000-0x0000000005D1C000-memory.dmp

      Filesize

      304KB

    • memory/4540-1084-0x0000000075110000-0x00000000758C0000-memory.dmp

      Filesize

      7.7MB

    • memory/4540-1085-0x0000000075110000-0x00000000758C0000-memory.dmp

      Filesize

      7.7MB

    • memory/4540-1086-0x0000000075110000-0x00000000758C0000-memory.dmp

      Filesize

      7.7MB

    • memory/4540-1087-0x000000007511E000-0x000000007511F000-memory.dmp

      Filesize

      4KB

    • memory/4540-1088-0x0000000075110000-0x00000000758C0000-memory.dmp

      Filesize

      7.7MB

    • memory/4540-1089-0x0000000006370000-0x0000000006914000-memory.dmp

      Filesize

      5.6MB

    • memory/4540-1090-0x0000000005DC0000-0x0000000005E14000-memory.dmp

      Filesize

      336KB

    • memory/4540-1108-0x0000000075110000-0x00000000758C0000-memory.dmp

      Filesize

      7.7MB

    • memory/4540-1-0x0000000000410000-0x0000000000472000-memory.dmp

      Filesize

      392KB