Overview

overview

10

Static

static

7

233f95c87f...31.exe

windows7-x64

7

233f95c87f...31.exe

windows10-2004-x64

7

2d8ea1230d...aa.exe

windows7-x64

10

2d8ea1230d...aa.exe

windows10-2004-x64

10

34dba85bb2...1a.exe

windows10-2004-x64

7

463d0b0903...ea.exe

windows7-x64

1

463d0b0903...ea.exe

windows10-2004-x64

1

4bcf45bde8...39.exe

windows7-x64

10

4bcf45bde8...39.exe

windows10-2004-x64

10

5292b8004f...ce.exe

windows7-x64

10

5292b8004f...ce.exe

windows10-2004-x64

10

6babc5b52d...53.dll

windows7-x64

3

6babc5b52d...53.dll

windows10-2004-x64

3

85b73b7b3c...45.exe

windows7-x64

10

85b73b7b3c...45.exe

windows10-2004-x64

10

8eb41b097a...ff.exe

windows7-x64

10

8eb41b097a...ff.exe

windows10-2004-x64

8

932380926b...ef.exe

windows7-x64

7

932380926b...ef.exe

windows10-2004-x64

7

9d8729b9ca...de.exe

windows7-x64

10

9d8729b9ca...de.exe

windows10-2004-x64

8

9e147a3bb2...53.dll

windows7-x64

8

9e147a3bb2...53.dll

windows10-2004-x64

8

bccfdc8e1a...96.exe

windows7-x64

7

bccfdc8e1a...96.exe

windows10-2004-x64

7

bf5a9bb619...d7.exe

windows7-x64

3

bf5a9bb619...d7.exe

windows10-2004-x64

3

d0017384df...0a.exe

windows7-x64

3

d0017384df...0a.exe

windows10-2004-x64

3

d72aa8fe30...89.exe

windows7-x64

3

d72aa8fe30...89.exe

windows10-2004-x64

7

fa622e0a4d...52.exe

windows7-x64

1

Resubmissions

15/11/2024, 18:05 UTC

241115-wpjcdsxrdy 10

11/11/2024, 21:40 UTC

241111-1h6xbsxcql 10

03/12/2022, 17:54 UTC

221203-wg4ncscc33 10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 21:40 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe

  • Size

    215KB

  • MD5

    926677dc69319999351c0771c03ca302

  • SHA1

    0d36a4435c234015d7c3207762b08c1924272753

  • SHA256

    34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a

  • SHA512

    3e34fb409fec7dbe39a6f3e19a0db3f97ac944dfa0c0ffecc00d5510285fe99f42ba80cb6a910f834cb7ba47b487329dc1facc168ce970de34a8e2a32c5abe42

  • SSDEEP

    1536:8I47GyTGCwiSnmQUt0LB18rs5gc3H2KrmswOOF+xcYPit0AQ:8vGyYiSDnt18w5X3HrrmsQMxDqqAQ

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe
    "C:\Users\Admin\AppData\Local\Temp\34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3868
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3248

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    69.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    69.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    72.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    72.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
  • flag-us
    DNS
    www.filifilm.com.br
    SETUP_~1.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.filifilm.com.br
    IN A
    Response
No results found
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    69.209.201.84.in-addr.arpa
    dns
    72 B
     132 B
     1
    1

    DNS Request

    69.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    72.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    72.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    11.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    11.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    65 B
     127 B
     1
    1

    DNS Request

    www.filifilm.com.br

  • 8.8.8.8:53
    www.filifilm.com.br
    dns
    SETUP_~1.EXE
    130 B
     254 B
     2
    2

    DNS Request

    www.filifilm.com.br

    DNS Request

    www.filifilm.com.br

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3248-5-0x000000007481E000-0x000000007481F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3248-6-0x0000000000EE0000-0x0000000000EE8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/3248-7-0x0000000005EC0000-0x0000000006464000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/3248-8-0x0000000005910000-0x00000000059A2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/3248-9-0x0000000074810000-0x0000000074FC0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3248-10-0x00000000058E0000-0x00000000058EA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3248-11-0x000000007481E000-0x000000007481F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3248-12-0x0000000074810000-0x0000000074FC0000-memory.dmp

    Filesize

    7.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.