Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03-10-2024 18:53
General
-
Target
ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe
-
Size
484KB
-
MD5
4a4c09d3cbef544cf8342e80d783c450
-
SHA1
cdb8cae2a8260dd78df6030edaa6d39ef21b8ec9
-
SHA256
ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805a
-
SHA512
ce80ed4806ed4251d8f78295f3dbf1a0d6b1cd3d8e2c6aa124fd4bda22b97fd848ea080a7affc5cd3b9ba56e4d026b393df2140b94d0b9e02c6f4245c8732714
-
SSDEEP
12288:2LPkCDt1EG2XVekhdeT/iKgVFdcuzb7EXS:2LPkQ1bqAHiXBn7ES
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe"C:\Users\Admin\AppData\Local\Temp\ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dfrgasks\efsustsc.exe"C:\Users\Admin\AppData\Roaming\dfrgasks"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~BCB8.tmp3512 496136 3632 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 6243⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\EhStName.exeC:\Windows\SysWOW64\EhStName.exe -s1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3552 -ip 35521⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
484KB
MD5476f58a019cc032125e4db93b8029020
SHA174bacffe96ae150bc5fc715b4851471c205969de
SHA256eb8c7c30fd23ab1aff7e83de217c100de9de5679dc35a3727dd1212bf9c9fff7
SHA51283d6ade3773163bbdff7bc23c7e8a496911c2b69b2301daba654189e793acd8d512dae0cad511b4572d3a0e3a02a347a9d9618f42e5bef7844e4a7797e4db1f1
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
524KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
524KB
-
Filesize
548KB
-
Filesize
548KB
-
Filesize
52KB
-
Filesize
24KB
-
Filesize
548KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
24KB
-
Filesize
524KB