83239ee058d2a5bf120848dd900654a94c770cce8c4cbe2a971b861795316a98

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/11/2024, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dimethylcadmium.exe-main.zip
Size 10.2MB
Sample241107-byx7pasgnm
SHA256 83239ee058d2a5bf120848dd900654a94c770cce8c4cbe2a971b861795316a98
MD5 4fbed3a4ec1f70d0e89019b3569748a3
SHA1 f5acdf821a2387c7c31f1cfe0a89af565271507d
SHA512 2ad8e34114d5e1e0736be97d736e5f4bb84fc3ef896d9d6f5addb09358563f4b92c8254ed4c258746ce06d599ad9e9d2abc1c1421dbcd0b6a7dd06f7e1abb188
SSDEEP 196608:rY7z7QWr7+US5gpmjnY2SL0pE3lQU8PARo94wd/yVuL6im99oEfRxYQ1/i0dk8Fu:rY7z71m1uL0kuUy9d/yVuIYOaAxm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2760	Dimethylcadmium.exe

Loads dropped DLL 3 IoCs

pid	Process
2760	Dimethylcadmium.exe
2760	Dimethylcadmium.exe
2760	Dimethylcadmium.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dimethylcadmium.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1508	vlc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2160	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2160	7zFM.exe
1508	vlc.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	2160	7zFM.exe
Token: 35	2160	7zFM.exe
Token: SeSecurityPrivilege	2160	7zFM.exe
Token: SeSecurityPrivilege	2160	7zFM.exe
Token: 33	1144	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1144	AUDIODG.EXE
Token: 33	1144	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1144	AUDIODG.EXE
Token: 33	1508	vlc.exe
Token: SeIncBasePriorityPrivilege	1508	vlc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2160	7zFM.exe
2160	7zFM.exe
2160	7zFM.exe
2160	7zFM.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe
1508	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1508	vlc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2760	2160	7zFM.exe	31
PID 2160 wrote to memory of 2760	2160	7zFM.exe	31
PID 2160 wrote to memory of 2760	2160	7zFM.exe	31
PID 2160 wrote to memory of 2760	2160	7zFM.exe	31
PID 2160 wrote to memory of 2760	2160	7zFM.exe	31
PID 2160 wrote to memory of 2760	2160	7zFM.exe	31
PID 2160 wrote to memory of 2760	2160	7zFM.exe	31

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Dimethylcadmium.exe-main.zip"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\7zO07825487\Dimethylcadmium.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO07825487\Dimethylcadmium.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2760

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2456

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1508

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dimethylcadmium.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO07825487\Dimethylcadmium.exe
Size 59KB
SHA256 36504aead5b06ea8d0dfc3d01c7a38063f1895e8c146756d44b6792210c8f072
MD5 88447f4d05e7d9cb19c11333c1bfa788
SHA1 1059cc274a2de48f50629cd924aec5bfc307b817
SHA512 64b7584612e6a71c84a1decd954cb3b2698801193a6fee8492325d59032ecba596d3c3c5b5ae4796224c000bfbd08921eb3ed760146f0d9c141a54790fdb0a2e
SSDEEP 768:C414KuzvDEqWF3lI5oiVVG+A1yAR2PmD48:ziqjoG+Gxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1508-34-0x000000013F600000-0x000000013F6F8000-memory.dmp

Download

memory/1508-35-0x000007FEF66C0000-0x000007FEF66F4000-memory.dmp

Download

memory/1508-36-0x000007FEF53A0000-0x000007FEF5656000-memory.dmp

Download

memory/1508-37-0x000007FEF3FD0000-0x000007FEF5080000-memory.dmp

Download

memory/2760-16-0x0000000000400000-0x0000000000415000-memory.dmp

Download