Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/10/2024, 03:20
General
-
Target
Cableguys.Nicky.Romero.Kickstart.2.v2.0.6-TeamCubeadooby.exe
-
Size
4.6MB
-
MD5
f57303ea0592088dc7efc67469008966
-
SHA1
8d922cc263730b21f44f85d12579e9241ff651e1
-
SHA256
d6b7d9152fb33488f4618cd609d61d53b30d9608d9fafbeabd98bc7f31dcc0e9
-
SHA512
a3c0caf864f8ddeb3206a5ea9e815bddb63996372a409c2ab8ecf5293b03bf3c99bb9e3be439c6f189f82b127ab46f20c38bd6ba226d5ae9a016145874f88e96
-
SSDEEP
98304:xkLQThyHj51/hngst7GFlO/tZmCfJPJDJk5NSsxWxc0Ry8C1c7P1ESGoHMpBVbhy:i6hyHf/xpGstZmCBPbMZxEfRPl9TzyXy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 26 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cableguys.Nicky.Romero.Kickstart.2.v2.0.6-TeamCubeadooby.exe"C:\Users\Admin\AppData\Local\Temp\Cableguys.Nicky.Romero.Kickstart.2.v2.0.6-TeamCubeadooby.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8V0E0.tmp\Cableguys.Nicky.Romero.Kickstart.2.v2.0.6-TeamCubeadooby.tmp"C:\Users\Admin\AppData\Local\Temp\is-8V0E0.tmp\Cableguys.Nicky.Romero.Kickstart.2.v2.0.6-TeamCubeadooby.tmp" /SL5="$9004E,3740709,808448,C:\Users\Admin\AppData\Local\Temp\Cableguys.Nicky.Romero.Kickstart.2.v2.0.6-TeamCubeadooby.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5d2db8c23f67f42e0784bcd393fed5aff
SHA1464bc68cde14868b9e3ea779c5a30d6774fba368
SHA2562336a52a3c35a472045a20d38fb9978c90b665dad77184f4fe59a3287a6be3cd
SHA512c4aa9ae07e20f5d9c8edbd4850deacf81817e295ff2eddc2a4590f1e844c82278cbc3684dfe0c2d5746b218450f2f42b029b780fd4b47f34b4dc52ba075edda9
-
Filesize
46B
MD592872f8ac2aed2db0b07e0bd2a2cc207
SHA16f7560add23274d6e0482754c186b59518269112
SHA256524c4940611c5338397e0bbdd9f23c030da1e5387f772a38b1599b467be78732
SHA51217b4a82fe65178e7701c61239d951155929a1b950c1ad35cd214286fa05032b10f1300bb01ef25910d4685e67dcd511da5f13de531e2210fc413ad77528969df
-
Filesize
20KB
MD502684ed2859a72684fe37a4b9a2ed8c1
SHA19bc396ec9b8855a4179cb0ffa94a1560cd28ab15
SHA25632e6e5fa0b708996560b229f8a20b56b4fcdd3a74982c660b834f61db327ce60
SHA512041d45c5f4b65000a5d3581df6ec681fd3374f5602c1a7e3a686d603e87bcf4b054830ba3a28c15bd893efe9b9ed597b711d9a8384c7dd09cbf282bd4320fe62
-
Filesize
3.0MB
MD52ac9f67bcf969baca37ad2485709d999
SHA19ad72faa583059023db7e50d5aa237b3c180ae9c
SHA256d2e1308870a8f00775c43504a0d2d2e77deac507d9893489ebc0d15cef7f864e
SHA512e3c3a824d41631f0b07212d325ac8875355db98434f0902bf9ca234d4988ef012f58e6508147c0b475317adbbe5a4a1b873beac3710878a4825477191e5906a0
-
Filesize
728KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB