Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2024, 21:32

General

  • Target

    Dokan.exe

  • Size

    658KB

  • MD5

    b2e209833057cc4780209a6002c45d12

  • SHA1

    8ce9986d09e446ac9781de6de39d8cff765d8f98

  • SHA256

    3d676ce6e3a12c14f275b03f64d73d49463a0ff946a5f661b603559025e71a84

  • SHA512

    d39222d0136f27cf01b14cc147eb149e266e55f8bc265fd15b158d785bc246f02be3a0156c79ceb96ee5d2142cb2c85ed6bdc563633cbdb142c60fc90fc97288

  • SSDEEP

    12288:zgFlvmqVx1SCW6rER4afkJPAPO1Bet3+xii6hD+ueolM:cbwCEyLJKOmeFO6ue0M

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Dokan.exe
    "C:\Users\Admin\AppData\Local\Temp\Dokan.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2232

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\nsoFAA5.tmp\System.dll

          Filesize

          11KB

          MD5

          883eff06ac96966270731e4e22817e11

          SHA1

          523c87c98236cbc04430e87ec19b977595092ac8

          SHA256

          44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

          SHA512

          60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390