Analysis

  • max time kernel
    14s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 16:48

General

  • Target

    59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe

  • Size

    1.7MB

  • MD5

    d0a2ce9c3713480f80a4ba511d926e10

  • SHA1

    6b4bcb74a6303b50f9360f44af9301debdae57e7

  • SHA256

    59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6d

  • SHA512

    b83cf9567617b86beef564709d48e44be007c6104dd1553fca66207882764324c87ace82f674c5beb0c2f9eb8a3a8a56f3f2546e8a0618e6f145140a1e5f26a4

  • SSDEEP

    24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNz:mbTChxKCnFnQXBbrtgb/iQvu0UHOq

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe
    "C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1612
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1536
          • C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 1612
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1784
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2196
              • C:\Users\Admin\AppData\Local\Temp\wtmps.exe
                "C:\Users\Admin\AppData\Local\Temp\wtmps.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2632
                • C:\Windows\SysWOW64\mscaps.exe
                  "C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2576
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:580

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3A23.tmp

    Filesize

    406B

    MD5

    37512bcc96b2c0c0cf0ad1ed8cfae5cd

    SHA1

    edf7f17ce28e1c4c82207cab8ca77f2056ea545c

    SHA256

    27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f

    SHA512

    6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641

  • C:\Users\Admin\AppData\Local\Temp\wtmps.exe

    Filesize

    276KB

    MD5

    75c1467042b38332d1ea0298f29fb592

    SHA1

    f92ea770c2ddb04cf0d20914578e4c482328f0f8

    SHA256

    3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373

    SHA512

    5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe

    Filesize

    1.7MB

    MD5

    15739313180b79c273804a34272c62e6

    SHA1

    7653fa6237c825e817c9f46db917207b5971824a

    SHA256

    5cf6b0b41da78b571f716caf1a6ade00622d5023b85cb8c9a400b7d71bd3e602

    SHA512

    824305999a0b3059d914d479f0701c083daf52027440f40595d7323450ccbaf3a195d45399363ff142f1a562a96e1fb1e834c67503307ca4638008d869487285

  • C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe

    Filesize

    1.7MB

    MD5

    1d67419af666dd26092c3c480a7daf24

    SHA1

    d689bc74e7b732298e3803ea297d8917294a8dbe

    SHA256

    4b068dbd5d5f436889d211d7ab67feaec5c72cba721c34ffb71e557afceb264d

    SHA512

    d2bbdf3dd0c2eaae8b43d02effc2785f5e2ea2d0a676d5a27b9fdacefe13fd4131e51bcd305bc1c6bb04f27e598b6cf1ffae7e732f3bf60cdeca98c207bd50cf

  • C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat

    Filesize

    129B

    MD5

    d1073c9b34d1bbd570928734aacff6a5

    SHA1

    78714e24e88d50e0da8da9d303bec65b2ee6d903

    SHA256

    b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020

    SHA512

    4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f

  • C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat

    Filesize

    304B

    MD5

    fb6b21742affc21307818e4c3d1bcfec

    SHA1

    158898d3e999db397fa5d42e1967dfb287e13566

    SHA256

    2996c755a0970493cb10d72d2ba86fcf1fdcb925d4c660b869ca6289a4f7e95a

    SHA512

    18e6d76ef737e6ba7ca32eb589a3850a17a3d7445619ece06ad1dde34b47782a45bc3a70951f5df8c632061951f0418b0b56d7d3df1b39024088f347f437ae0a

  • C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat

    Filesize

    126B

    MD5

    dd552a153d81fe8c472e9a937a51931a

    SHA1

    f70764fe4feeafe5825cf1a11ddf46a048165b4e

    SHA256

    6ebd392227673b24daf54fbfcb267d97a4c324b0a8f57a326315781a52a8225d

    SHA512

    8c7756da6559d86eec2b89b7c01c49abb14833925b32cee01d2bbcf2036840aa6659a4b98e76fc0688729527288aceb42d41b871ed0a88594524fa410776f467

  • C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat

    Filesize

    102B

    MD5

    3ca08f080a7a28416774d80552d4aa08

    SHA1

    0b5f0ba641204b27adac4140fd45dce4390dbf24

    SHA256

    4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0

    SHA512

    0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01

  • C:\Users\Admin\AppData\Roaming\Temp\mydll.dll

    Filesize

    202KB

    MD5

    684c111c78f8bf6fcb5575d400e7669c

    SHA1

    d587894c0beffdff00ae6d358a5463ef18bcb485

    SHA256

    080fb4cd0b92884c89efab9161685f3ba0666cd9dab8de6c752bfe35e4e45716

    SHA512

    bcf748d21be502d7346f56ffc9ef13f3394d46c679d7cf17289d007e91b4ead2ec4035b3ccd5626eb378958cbb6ac371edfde8319433db9b709694595ae53e4f

  • C:\Windows\SysWOW64\mscaps.exe

    Filesize

    200KB

    MD5

    78d3c8705f8baf7d34e6a6737d1cfa18

    SHA1

    9f09e248a29311dbeefae9d85937b13da042a010

    SHA256

    2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905

    SHA512

    9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609

  • \Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe

    Filesize

    172KB

    MD5

    daac1781c9d22f5743ade0cb41feaebf

    SHA1

    e2549eeeea42a6892b89d354498fcaa8ffd9cac4

    SHA256

    6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c

    SHA512

    190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160

  • \Users\Admin\AppData\Roaming\Temp\mydll.dll

    Filesize

    202KB

    MD5

    7ff15a4f092cd4a96055ba69f903e3e9

    SHA1

    a3d338a38c2b92f95129814973f59446668402a8

    SHA256

    1b594e6d057c632abb3a8cf838157369024bd6b9f515ca8e774b22fe71a11627

    SHA512

    4b015d011c14c7e10568c09bf81894681535efb7d76c3ef9071fffb3837f62b36e695187b2d32581a30f07e79971054e231a2ca4e8ad7f0f83d5876f8c086dae

  • memory/1784-266-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB

  • memory/2280-0-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB