Analysis

  • max time kernel
    103s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/11/2024, 07:36

General

  • Target

    5f97099c9597917ad3091e70910dc93ded0181185c1878fa4dfffaf540b46e4b.exe

  • Size

    1.1MB

  • MD5

    7ff7fe2c6873fe797424222a0b5870e4

  • SHA1

    d6667dffbf6623ee8e6c3a081243725250d9113d

  • SHA256

    5f97099c9597917ad3091e70910dc93ded0181185c1878fa4dfffaf540b46e4b

  • SHA512

    cc1c7bcfe8fe67d6b3664c519464751816db2fc1fff48a57be7bdadf563eaa55129687f975c234888e771052844223228c63fca4b8711a380c42021327014264

  • SSDEEP

    12288:Xtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSga0yln5XgYQ3J9a+PN2O5:Xtb20pkaCqT5TBWgNQ7a0G5X4s+wO6A

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f97099c9597917ad3091e70910dc93ded0181185c1878fa4dfffaf540b46e4b.exe
    "C:\Users\Admin\AppData\Local\Temp\5f97099c9597917ad3091e70910dc93ded0181185c1878fa4dfffaf540b46e4b.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Users\Admin\AppData\Local\Fonda\Bohmerwald.exe
      "C:\Users\Admin\AppData\Local\Temp\5f97099c9597917ad3091e70910dc93ded0181185c1878fa4dfffaf540b46e4b.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3228
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Users\Admin\AppData\Local\Temp\5f97099c9597917ad3091e70910dc93ded0181185c1878fa4dfffaf540b46e4b.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Fonda\Bohmerwald.exe

    Filesize

    1.1MB

    MD5

    7ff7fe2c6873fe797424222a0b5870e4

    SHA1

    d6667dffbf6623ee8e6c3a081243725250d9113d

    SHA256

    5f97099c9597917ad3091e70910dc93ded0181185c1878fa4dfffaf540b46e4b

    SHA512

    cc1c7bcfe8fe67d6b3664c519464751816db2fc1fff48a57be7bdadf563eaa55129687f975c234888e771052844223228c63fca4b8711a380c42021327014264

  • C:\Users\Admin\AppData\Local\Temp\slashing

    Filesize

    91KB

    MD5

    ac298e33ec8d28eebdef77dd78055100

    SHA1

    724b420cd53ede6d20c06091ef6f93595cc526e4

    SHA256

    258bc185214703ef73acb225c39ccd845ee8d267ca019e25db5bf4c95305996d

    SHA512

    a4a9339c5456e4f7e71042cad50c4ef8f6129cace8f5965cc8817e591ea3d396afeafa2ba54877b8018233d26f81db2a909553d55828e7c4c0a34831148b25ab

  • memory/2064-25-0x0000000005CA0000-0x0000000005D32000-memory.dmp

    Filesize

    584KB

  • memory/2064-20-0x00000000005C0000-0x00000000005DE000-memory.dmp

    Filesize

    120KB

  • memory/2064-21-0x0000000073C1E000-0x0000000073C1F000-memory.dmp

    Filesize

    4KB

  • memory/2064-22-0x00000000050D0000-0x0000000005674000-memory.dmp

    Filesize

    5.6MB

  • memory/2064-23-0x0000000004C00000-0x0000000004C9C000-memory.dmp

    Filesize

    624KB

  • memory/2064-24-0x0000000073C10000-0x00000000743C0000-memory.dmp

    Filesize

    7.7MB

  • memory/2064-26-0x0000000005C50000-0x0000000005CA0000-memory.dmp

    Filesize

    320KB

  • memory/2064-27-0x0000000006010000-0x00000000061D2000-memory.dmp

    Filesize

    1.8MB

  • memory/2064-28-0x0000000005FB0000-0x0000000005FBA000-memory.dmp

    Filesize

    40KB

  • memory/2064-29-0x0000000073C1E000-0x0000000073C1F000-memory.dmp

    Filesize

    4KB

  • memory/2064-30-0x0000000073C10000-0x00000000743C0000-memory.dmp

    Filesize

    7.7MB

  • memory/2816-6-0x00000000011C0000-0x00000000015C0000-memory.dmp

    Filesize

    4.0MB

  • memory/3228-18-0x00000000009F0000-0x0000000000DF0000-memory.dmp

    Filesize

    4.0MB