Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-10-2024 08:25
General
-
Target
b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe
-
Size
4.5MB
-
MD5
fa31a70b20d5d1666ddd40cf3305e334
-
SHA1
530a9bc75d351810f8e4690a7041339ce255bbe0
-
SHA256
b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94
-
SHA512
5cfe701112133127ac73a302ac9a1ce3f1f6da42d60fffed1007f9931cb47bcd6d0d5557a25faaecf1c692d1f70916cc6c1136619703f9c71c171663377b9fa0
-
SSDEEP
49152:1z6XIrSYssIOfbCcWYLdNBpQkdmTlrg12d8xfMHFnJgxy5CVB0cEWxPZ/xHdbrsi:1+Pc2Q2d6Ml6xBB0nWxPZDuJWP
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
-
C:\Users\Admin\AppData\Local\Temp\b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe"C:\Users\Admin\AppData\Local\Temp\b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Music\tomemb.exe"C:\Users\Public\Music\tomemb.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576KB
MD51273d6d6be7ef615d07ece772e1db9d1
SHA14936d2d7c7d9e44837a341289aecfa785b541aac
SHA2563a0673e15e7c6b19c989105077e49fe73483ab180f55138b86baa05b9598da3c
SHA5122d61ae001d6acdc48ce4e6bedb4007a8650fd1cc09aba76f5ca9badddbc622aa656cba2e4d789d32e126ec152e3010efbf7c4a8dd4ab5a62c471f1f03e6fa28e
-
Filesize
116KB
MD5a58593c975d020cbcad9f06d87f80444
SHA1d3e206bbb811ee0ddb62fe9459a042fa4c344a01
SHA256b5579f9e315cc2cfda4e0a337d42f03e31f5963abe1b274f2f857e44131386c0
SHA512066f195e15a608ad1c9ec2c85a0d6d6e1964b09e8fb8932db79adcc74d2f041110823d16b4f8991f000463e484ddb76e92515bcdd8e4064f8112cfdf8e157a8c
-
Filesize
243KB
MD5c6a9fb54e338765cfb396ac72801bd56
SHA107b0329d2a82c38d67a7ddcca8612dcb41f1dc1d
SHA256ce383621cbbdc57b24515b312517e294ee38bb48fd405710228843cdbe445056
SHA512ae640c97b4da26fe9418f48bf6da4c9f470a9ad24d0809dfc3e3b18a81ec63e9b7ee79a8f9e5640a7aa91a42a6fdfc48520cd25de8eb2d3fbd3bc9e93b8f5468
-
Filesize
108KB
-
Filesize
592KB
-
Filesize
244KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
200KB
-
Filesize
516KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
224KB