Overview

overview

7

Static

static

3

842a5441a2...5N.exe

windows7-x64

7

842a5441a2...5N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    19s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19/11/2024, 18:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    842a5441a24e8f4a30069f2c925df0855f4355240ca7fccb51c0cfaba0f169b5N.exe

  • Size

    1.4MB

  • MD5

    767ff159e6df2d845054f670c848fa40

  • SHA1

    e11f65b9e839c1151bc0cc05b63bd8f6dc016464

  • SHA256

    842a5441a24e8f4a30069f2c925df0855f4355240ca7fccb51c0cfaba0f169b5

  • SHA512

    fb685dceab7ca725479677957590ffab0b4f1e415009831fdfb5ae4e211e5f776ee616f1531f7bae6a14f7d1f170afddcb0f79deccacf2de12f25ef87c7be729

  • SSDEEP

    24576:+Cge4x02Y3FEdtiWCS/SwZry1onErH6yj/VpIxIS9FH3Y+q9ZY2mxKv:IW2ddtiWVqNYUVkNFXo7

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\842a5441a24e8f4a30069f2c925df0855f4355240ca7fccb51c0cfaba0f169b5N.exe
    "C:\Users\Admin\AppData\Local\Temp\842a5441a24e8f4a30069f2c925df0855f4355240ca7fccb51c0cfaba0f169b5N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2296
    • \??\c:\users\admin\appdata\local\temp\842a5441a24e8f4a30069f2c925df0855f4355240ca7fccb51c0cfaba0f169b5n.exe 
      c:\users\admin\appdata\local\temp\842a5441a24e8f4a30069f2c925df0855f4355240ca7fccb51c0cfaba0f169b5n.exe 
      2⤵
      • Executes dropped EXE
      PID:2064
    • C:\Users\Admin\AppData\Roaming\icsys.icn.exe
      C:\Users\Admin\AppData\Roaming\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2244
      • \??\c:\windows\SysWOW64\explorer.exe
        c:\windows\system32\explorer.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\842a5441a24e8f4a30069f2c925df0855f4355240ca7fccb51c0cfaba0f169b5n.exe 
    Filesize

    1.2MB

    MD5

    36434a062f5ca2210aa8882098603610

    SHA1

    ff4dc56c0f0b0657c17e0205b9aa2a1c036bd4d2

    SHA256

    c705fa69f06a4a6c3af8067ca52040b2630ade7b1d59fe4a6ae5fa7f32382bee

    SHA512

    5f41fd27f14b9ae6301306e220fadebe5bb27f0917a3c9d9b37376ed0b17651b366404e13e2e44ae0e8d81fca3db865a5cb3271ef9320c51ee309aeb04a06e8f

    Download Submit

  • \Users\Admin\AppData\Roaming\icsys.icn.exe
    Filesize

    206KB

    MD5

    9662fa1fc8c05aa785823d1642e37188

    SHA1

    810b6565d594bbc95dc11488bb40837e4ea35e3a

    SHA256

    3c532e17b0681eb19e4ad409a890c5b99891209a579b81f39b99e042250e87d3

    SHA512

    adf5ed9c579d625adb0f6d11fc4a88bd1e9fd63ddb7bccecbd68c6033f790cd8165f8e5820ae571d39acbd6cfe3280ea05c0870bba4fba69cde1705a0370958b

    Download Submit

  • memory/2064-12-0x0000000000400000-0x0000000000539000-memory.dmp

    Filesize

    1.2MB

    Download