75d8656a5d15e60dfb2ff1d24dd311c981992be1f8443192df9984e0b9cd9690

Resubmissions

12/10/2024, 02:03

241012-cgtzdawhlb 7

12/10/2024, 01:59

241012-ceefxa1dkl 7

Analysis

max time kernel
140s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

keymouseclicker_setup_v1.0.exe
Size

16.7MB
MD5

2aba74f10ab74dbdf67758ffcb0777c9
SHA1

9bd64522f03000579ad86ddd28d2c287c601f99d
SHA256

75d8656a5d15e60dfb2ff1d24dd311c981992be1f8443192df9984e0b9cd9690
SHA512

818702f136813c49988d66f863f37c6962c7a4875d5aaae28df5317526881412ebd035e1881c4e83cb74f7d1690f892eea6d9ae9fe544642a4906ef4d41aa6e8
SSDEEP

393216:zOBXQTb1DA2HWTQKEli2KtI9jTKr914hc6IMKT43s:CRQTb1E2HqQKkiF69jOahxSs3s

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2952	keymouseclicker_setup_v1.0.tmp

Loads dropped DLL 1 IoCs

pid	Process
1732	keymouseclicker_setup_v1.0.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keymouseclicker_setup_v1.0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keymouseclicker_setup_v1.0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2952	keymouseclicker_setup_v1.0.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2952	1732	keymouseclicker_setup_v1.0.exe	30
PID 1732 wrote to memory of 2952	1732	keymouseclicker_setup_v1.0.exe	30
PID 1732 wrote to memory of 2952	1732	keymouseclicker_setup_v1.0.exe	30
PID 1732 wrote to memory of 2952	1732	keymouseclicker_setup_v1.0.exe	30
PID 1732 wrote to memory of 2952	1732	keymouseclicker_setup_v1.0.exe	30
PID 1732 wrote to memory of 2952	1732	keymouseclicker_setup_v1.0.exe	30
PID 1732 wrote to memory of 2952	1732	keymouseclicker_setup_v1.0.exe	30

C:\Users\Admin\AppData\Local\Temp\keymouseclicker_setup_v1.0.exe
"C:\Users\Admin\AppData\Local\Temp\keymouseclicker_setup_v1.0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\is-TKTAG.tmp\keymouseclicker_setup_v1.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TKTAG.tmp\keymouseclicker_setup_v1.0.tmp" /SL5="$40110,16674729,814592,C:\Users\Admin\AppData\Local\Temp\keymouseclicker_setup_v1.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-TKTAG.tmp\keymouseclicker_setup_v1.0.tmp

Filesize
3.0MB

MD5
6a5e5d192d24e86ef8b88028d992bd5f

SHA1
df775472feda315bc9c33bb2062d136c7988eff4

SHA256
0a6df8313d982262bd805e3320b9bd07939c7b9823032442dc91458ba94cad1c

SHA512
b40dd4153458d8c1bd43deac78a0d32a6fb38a0ade16a455375b0613e7b8eb68350e9c5afd5d291aa3cda9b2f007443214903d66d10717e5051e11bd222ad13c

Download Submit
memory/1732-0-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1732-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1732-10-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2952-8-0x0000000000400000-0x0000000000710000-memory.dmp

Filesize
3.1MB

Download
memory/2952-9-0x0000000000400000-0x0000000000710000-memory.dmp

Filesize
3.1MB

Download