Analysis
-
max time kernel
115s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 16:47 UTC
Behavioral task
behavioral1
Sample
e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
Resource
win10v2004-20240802-en
General
-
Target
e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
-
Size
483KB
-
MD5
4407e9b5c2822d8df76aeaebe6cc8510
-
SHA1
688fc138a465035489078457c60b982c2814dced
-
SHA256
e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306
-
SHA512
5d1b8d2c71906d73425a22b6edc5e9db7d862109f568ca23d43751ca4e0582c673c58d6f5ced0e444bc81655c66d1fbb7a30bb8a5608a8a776530e3304abf531
-
SSDEEP
6144:rXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZ5AXIcN35Gv:rX7tPMK8ctGe4Dzl4h2QnuPs/Z5qcv
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 808 WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2100 e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2100 wrote to memory of 808 2100 e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe 33 PID 2100 wrote to memory of 808 2100 e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe 33 PID 2100 wrote to memory of 808 2100 e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe 33 PID 2100 wrote to memory of 808 2100 e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe"C:\Users\Admin\AppData\Local\Temp\e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\qhqejvxgzmng.vbs"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:808
-
Network
-
DNScomandoespecial2023.duckdns.orge02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exeRemote address:8.8.8.8:53Requestcomandoespecial2023.duckdns.orgIN AResponsecomandoespecial2023.duckdns.orgIN A173.208.241.155
-
DNScomandoespecial2023.duckdns.orge02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exeRemote address:8.8.8.8:53Requestcomandoespecial2023.duckdns.orgIN AResponsecomandoespecial2023.duckdns.orgIN A173.208.241.155
-
Remote address:8.8.8.8:53Requestgeoplugin.netIN AResponsegeoplugin.netIN A178.237.33.50
-
GEThttp://geoplugin.net/json.gpe02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exeRemote address:178.237.33.50:80RequestGET /json.gp HTTP/1.1
Host: geoplugin.net
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
server: Apache
content-length: 955
content-type: application/json; charset=utf-8
cache-control: public, max-age=300
access-control-allow-origin: *
-
173.208.241.155:8888comandoespecial2023.duckdns.orgtlse02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe3.4kB 1.6kB 13 16
-
178.237.33.50:80http://geoplugin.net/json.gphttpe02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe347 B 1.3kB 6 3
HTTP Request
GET http://geoplugin.net/json.gpHTTP Response
200 -
173.208.241.155:8888comandoespecial2023.duckdns.orgtlse02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe1.2kB 981 B 8 8
-
173.208.241.155:8888comandoespecial2023.duckdns.orgtlse02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe65.0kB 1.9kB 57 29
-
8.8.8.8:53comandoespecial2023.duckdns.orgdnse02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe154 B 186 B 2 2
DNS Request
comandoespecial2023.duckdns.org
DNS Request
comandoespecial2023.duckdns.org
DNS Response
173.208.241.155
DNS Response
173.208.241.155
-
59 B 75 B 1 1
DNS Request
geoplugin.net
DNS Response
178.237.33.50
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD56d6dc6f817346a597baa504c54636c71
SHA1bf455f3f63a65a721c7cf428ec42a55a4a17eb8f
SHA256f4e336ba6c70ba98baf36011cf670bd6aa0a3d274e796206c5a68687b6296db4
SHA512c007d81817040695802687bba67102a4d248a990cbf6f0b649810b18d378f76af9297764d8ed15d5cec86c7bca4899187cd441b44c32fecf0cb56d6363e9fda4
-
Filesize
732B
MD5e37ca967a6c6fd157b186dc90f7352b1
SHA147f5341389e7b4e15bfa7540f7a9846d81fea0bd
SHA256ab8df3c1c054b81de732d70791fddc8220811004bdbf022734480d03aa4d54c5
SHA51287df7bf8fb14b2d74bf0d3501d83b38f66e56616e776e605e744de3ba29ae1f6610edcefcf3840cf811fbfab8cc345944168b41a62a48ae895ded34d58578551