Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/10/2024, 07:26
General
-
Target
0e45f6b1508e57119cee5ce8fbb7be9f33bc88a863780db5e576870156560cf1.exe
-
Size
79KB
-
MD5
b0c9a999c4a702fbf961957259f2b4da
-
SHA1
b0e92bb3499cb0870c1b4f8c12e31c815fba359b
-
SHA256
0e45f6b1508e57119cee5ce8fbb7be9f33bc88a863780db5e576870156560cf1
-
SHA512
fc30b88a9e60d201968aeabc3395d4ee7a7c0f43fd27091bd72ef2ae6e7c00a96b4870a5529817993265f43dbb471e7b6a54863ad6b98a575e2b2101f4082fae
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOfK:RshfSWHHNvoLqNwDDGw02eQmh0HjWOfK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e45f6b1508e57119cee5ce8fbb7be9f33bc88a863780db5e576870156560cf1.exe"C:\Users\Admin\AppData\Local\Temp\0e45f6b1508e57119cee5ce8fbb7be9f33bc88a863780db5e576870156560cf1.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5ef6cd18351a2db55b66fda1c1c8b72f0
SHA13bed5a64b696d9a2f35af9811d4528ed35b49ab6
SHA2567eb066a7f76cd956063f7bcf0bf97773a3fa44b5a09ea08106660782f69ad718
SHA51207c83b29526673c8e83d9ee4368cd7801aac3a2e8b7022f3bdae36ce50d7dba41bf696afd900601030357a6eb16c1f160adc13dd9822fcc447202f60954a9dfd
-
Filesize
78KB
MD56bc16a5ea6ceb84075a097d10a0700c7
SHA1c1e5f0252068617d196afbaa6ff6110c1d2e6cb4
SHA2561981c4a51ba481f5ea16adff6b0ac3db6f89122915bf41f357be922d401af3c4
SHA5120b03db92566f09616ba4462d13e11872ca8f64c5150903f32ee3ebe48fded79626fb8e1f3f4c469e7509f601706ea07a27601b34c824df6e9a63e55b5f55f6db
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB