Analysis
-
max time kernel
1793s -
max time network
1152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-11-2024 18:56
General
-
Target
Able2ExtractPro.exe
-
Size
236.4MB
-
MD5
501e18ebf35e79d49635098d798bdc22
-
SHA1
7432faca9ef46ecd481075b384cd93653aee5f86
-
SHA256
bcc36eb4303cacfe2059ac6c6fd131fab78374640feb721d2b5e98fcccd77a05
-
SHA512
db066cd4a1a41ab8d61d2083a19bce3a0299805c525623baa0af83cac2d7fc1a307bb9cea1e963e427a79df28cf3c75e865f9b8939c22f01c739e2ed98afe6d7
-
SSDEEP
3145728:6ZW39oISuin0oytQJBt4WE1ufL7W8mnwOKDoxHCTL:6w39oISuin0oRdJmEoE
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 21 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 58 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Able2ExtractPro.exe"C:\Users\Admin\AppData\Local\Temp\Able2ExtractPro.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Data\local\stubexe\0x1B95A89FFE874039\Able2ExtractPro.exe"C:\Users\Admin\AppData\Local\Temp\Data\local\stubexe\0x1B95A89FFE874039\Able2ExtractPro.exe" /864A627C-C6B2-464A-AA13-25D62F282BD82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32B
MD5ca224f871caccfcf8e2e5dd83f1ecc10
SHA165d796962d1d920a3c6a19f8b7e403ffb458ee18
SHA256fcdccfb7fc64e549576376b433057b670f5641eae38e5b0787a2edcfa06cbbd9
SHA51229f86df8b46bd645ec15c9b6c2c83715e19b93330ce6185f0925b6dd16d3db9ca1118d45d074b7c4d2451a1427d73ca9902914d63a04e2f65dd9afb8c0937ed3
-
Filesize
32B
MD572e79f5f05fca07ebed2322427602b51
SHA19ef786649c3f014fa86dda1e7b3a318189116ea4
SHA2564853b4f2d93bcb0813642235b168b75c283b2f20a32992417425344a8bbff15f
SHA512fe436cfd27b5383e6d43098a8513a80460e7529b50af50ccb262a2c1d1686bde9329978c4d8aaaf84735a9e78d8cae74634b6ef666b0f2cba75a838a4780c881
-
Filesize
985B
MD5502a7e90cdc547fd76968c24365be9c4
SHA1d0dde8ca45041de327c8b149513912d9136b977a
SHA25610f668cf9dd9983b4b86e044f2d49e6a0ec01da5c34630419181a05498d4022e
SHA5122f9a51a07f98b59384c960d1f0526f23c1f01185ef125a0aa3cad59ef099f9a814805ede71a1134b827ee895c08610ff93a94592c4f9b16c7f4e7ea697733f93
-
Filesize
591B
MD54d1adbe871c56633287f19cd8aafb1c9
SHA1fa002bebf163fb26b0901450922da295159db931
SHA2566dd0cad6d1deed3a3b95e4743a278365f84f55ba9b795aa2f511c4f9c835fa18
SHA5121a9fb0971d96c99b0a82ad8e1230acec309fa004ae61ed8be62e41644bcec757577a61bd38f1e2ee883364a5b3fecdd2a6c11f4e1d737f22de49ce1284b48435
-
Filesize
7.8MB
MD56ca9a5e6854fc8a1bc65252b7327f7a9
SHA155271b96a71dffb2feac47904dae268ffade9ece
SHA25610982aa00bdb3d9346725074195540c9b88362007479c1196851fd24f5944560
SHA512b30aa2e56b107788964cbbe2e530ad7b997b638ad273fc69922d7fe6a564620cd09daf60157edd7da2a876876b8d2646fe9ff3a5189b9f9ff57350e18af0e228
-
Filesize
36KB
MD5e8a045597651b58f792b066df79b0fc1
SHA184678c6bd71950846671e56c1bc40b5de22dd8c7
SHA25683a3d7cf9c9fc2f804d228853ecaac9f62da2f4bbd68f4c7c1634a9b8b3b30f0
SHA512c0acf76695fb079de2acc4cbf19408772715458a4f94eb1bcb0ff313e338f57290444bad7ab8487eb63eccf5719c2b4a58dbbfea579bbe64a4a26d7982d08133
-
Filesize
343KB
MD519a7608ad432e5d8db76e09b3490f325
SHA1436678cab52a8ba67dad73766dbdc8c5cf4417f6
SHA256f1e64543daba80f91aa4f55733f7149f77b6dd2d00bb00c627931ff5e8b5eedc
SHA512b3f676e0afb61f0dfa392dfc1b330ce5f08a7eaf2ae205e52f8d764848c18fc625e1bdfa7cbcd5077ff3b1c49f34f02601c0fa4a0809cf0307f8b92f5cb03608
-
Filesize
30KB
MD5fd6b2d97e35dc385790779c0f4442843
SHA108d27cd93c5a20e095da3f5c1cb663d37b01d58f
SHA2564e6944acae3fff958937e5acd7563ab879fcf3ab190e14e75fa8418ffeb2791b
SHA512813956d8efc5af486668a0da5ef3c7bfad627a0eb2eb6414938b75c7fea9885d93d263fc5a67615f6180d5abeaf8b97e7d41f78bde6384c316126bf997d651d8
-
Filesize
368KB
MD55405b0cada010b93706aea7024c4ea0d
SHA1b02948807750e4649f30a87b707d86b75e7f4127
SHA256d99d4e5bb25a3bbe5030d2a9d4fac8bcd05ac36500c66468d8782659621a471d
SHA512fc37b9c22633cdfd3582ba20e0fca3ea9ba2a8bc535bbb9e3af911dc7ad6e00c7f085987d2cecdfd304ad1ff6d5f30420ddbcf033cbc3299ac3694602f46e953
-
Filesize
28KB
MD57e710262179e039eed107b7cb0d9954a
SHA128aa67ecc472aba550910b2d5e9c5facaebafcbb
SHA256800c7677fcb9dcb1fb362f808523dcf3e551460aef6355b060866707d60fd31f
SHA512db8a67ce09828b5fc32dc4653c35a3d7a197d852801cdf473223ed25d91bc3fe942de761c3a1926d35be0b9488af6478556e4fe5edf2f0b78c1b4b9ddc80adda
-
Filesize
1.3MB
MD56bbde27034ce08b02fdd96362dfde6ec
SHA1cbbb66797525708992215f96b31026c408726396
SHA256d577792bb5a978cbc58cc7ef27669b49c2fc624b5c3510c27bbc772bffba723c
SHA5127bf0b40390aff2060369b094274a0b413365175bc973fe7fb638b28407a8f5f5bd2ba6df5eef789ec959b536d2443e1fb10272d3c8475dd5a108eff5db3b8c5b
-
Filesize
138KB
MD5d1d362ab0f4dd0bdb512e348dca991b0
SHA1fd5aedb9b9a053a8a476b27bba776afa33b13c5c
SHA256f743c2b49ef5048e9708ee2adfde2479ec18032d28a443ffac6185c47e881ea4
SHA5123eb29f0aecd7daa5facfdee315931570a4d2ca91f15ed5fac4fe5225fb6f401cc1cdd21d3152a62584fa68ab0a61b57f2302b5489e86de056afb96768b58d317
-
Filesize
28KB
MD5e940a95dd4430c0d9b902a8dd39b0376
SHA1f12da5745c84374a4bf3617281e75553fc48c894
SHA256f9994647ec5d8f3b68c51fc99b8e07dbde7ae8b91e05004d8708b796646b0164
SHA512849d8af70925401e52c8622c005b256994e2350c1363f603852c5a820ec1b7be2f1446a4d4ccce70caa3423e407e6d31fe2afefb7677316fdbd32ce895db2815
-
Filesize
1024B
MD55a89df948b2fe8bfe15d4059ddc506b4
SHA1e8a71650c905168a7959ba568a936feacea25a1d
SHA2563706ceb3e2434c369b1337922800dbe3ec214f1a87e1c70e11d02f46ed0e4028
SHA512405e0e17c9d663c4065a455961d5a76fbaf30f2461f34334277336e189724c33ab67cbb055369648e4ec1948285f0e73980dc3a3719c424c9401d611d8960e46
-
Filesize
1024B
MD57e0f7cf216226c345ba58e9acdda929d
SHA109f29a3647540e42aefe866899d4a7a1f655e54e
SHA256fda3da629d273c0cf141a6bb80b982b85ec5c7f660c73f6ee9d31700a7272630
SHA512bab3596eb5fda6f44a58a794f646ab3ea8c024f04abc4b53d3818c636971dd1527cbb0a3f74a1c8cb5130fbac5025eb1d97232b9482d139e4349662ae0c8a2d3
-
Filesize
1024B
MD5f56562b85b47fdca8956969c3c0ed523
SHA137c8ff64f7fab198760ce6fd6d1f3ec5fe15e241
SHA256ea8ef09133a259cf437277f4924561f2996230b06f980e40df01c91aa0bdd9ad
SHA512ef30d890b42714c9d71040a0a8a0b49322656f9e9d2142c3df48699545cb8a48ee36f2cf3967b7389628fd43e1b220328daa3fff7a062a7b97df7a60fb337ffe
-
Filesize
1024B
MD55c0b8243301f9746b2394286f341a2f5
SHA1e6687b86c29f2ddace2e4939c99a4817a547951e
SHA2563815677b381034c34fa0483253336c34cc5313f030ca32f0d6268235869cfe48
SHA51274215282015f499910cef0fe9736cb3142ed9d03ffe6a885a9f76f845c8a6a1e0cce10f9cf72e033a56ac6adf14a10d2a73035af6f59ffda336181522fe71357
-
Filesize
1024B
MD53ffbdd94cd15bb330e266e8ff68cb435
SHA190a409e9d0de2606f2151c4041c89c7ede656535
SHA2568d55f16620291707b2db0e5f85fb5b2ec52b5e9aa0040f72218959418dc94aab
SHA512fc582ef9847d27021f80f801fbdec1eaf4ad0770665de3390179dd1b777e1df08ed5d0b1a8c485b15a5b46f171160e346fb1d53758cd0bc4c86435f6d8c20ada
-
Filesize
1024B
MD5e10bc82d3201c2a854532d1d1e786a9b
SHA1f2d246a171f053dab0112e208ed00d11818fb1f5
SHA256509a178a4ff56fb56ad2936fade6e211962341d1f3df7d9c343276f378f172ba
SHA512ddf948b19de3fd7d54c095347aea11371fd6b3847aab1811118f37e05d13eac8fe56741e663b70a605ff45db2168d2bd896aa089addc17ff01cf06e2af24950d
-
Filesize
1024B
MD59b9fdb3ce0d1f0e59258885526ff42a2
SHA195e6286d31c333a8052500a33ab5c1c7a9be02dd
SHA256ef4baf1a8809f291dd2752a167b332bb22408ca5d9625b73f9b3937e2b1e4b40
SHA512a21588bd4e10ed7fb0bb9611eef1c600c56d82047d56234dd4389801fc734deddfea258c1c4dfeaabdb5c97d353bf55c3ce2899cce62a5554204dd95dcbfb4b5
-
Filesize
1024B
MD5dbc902fa9a53629ccbe49d842792f2e2
SHA1d27ce3d16917a42c885001f483e1a0f8ed55b586
SHA256e4cacad76c41b46006814b6da0b7cfbc3114db657e32c950c9e0860c0ac6089f
SHA512ba3cc0de18d1637903f1b0a34255c4375f4af164ddb04cf96352b92e51210a6835a425fddff8d72f410fde9126ae1a8376ea77260bf9e4148cf5a8d8a4cb2266
-
Filesize
1024B
MD52be38c4b54033cf64cf601401f42f51d
SHA1360fe64a15e64719d9b260a29fbb1ffa604e5fa3
SHA256c9fe74979ea230d66b77f8d8851db846939d75efd4418becd1591affc742d824
SHA512b33a4f7cf764b7411585e56792bbef65e884a91867d59f4386e273a79a4b498968d9126bd118c46e7441c7889e0a9c9150c78fc6dea3ebb7ffade0808ad17db8
-
Filesize
1024B
MD5d22ae9d8bed4ab529023c3a68992b7df
SHA19d2f9f7ead86a24b5a8f1f6b70a7f078fb84f1c8
SHA256c266fdb52165e17f54e26de264a7da5f025c03261b62e644e2097ce99d5b2f9d
SHA512735bb324d2a828302e649631b8276a72f084fd68a6f45b45c65b50ce38457d58703d587038da660863e90709b0d55ebf1370fa2f8d9009416de0fd1434418c4b
-
Filesize
1024B
MD525bf4b48a624bffa51e6cb3c3e5242b4
SHA1836baada49cbc6b3cdc52c55ddab5f2a85a80a1b
SHA2568480b2799c9fc147e15a25fa46b8fe7ec3f353ae8f971920899ff2e7d78d73fb
SHA51284536b7ede130ee944fb2187e78ca7b53deb8588fe08435097bb21d7f6b0dee8ce74d429017a4fe2e05cbc3d81e1273d76883813b408f49cbcfc83102fea34d6
-
Filesize
1024B
MD5bc7425f5aa7e538b8306375f501a5494
SHA1cbc70ad7004c3be2064061cb9cdfddbb47071aa3
SHA2565e20c20c6e87fdbfdc3a000d4fe031cd7ad23cf1b2833ad715046a8a471fe174
SHA512bb55b01c6a14a8c876c5b6babd5910dbd20d55e81570e5675d63a7b0cf4acd6d74bdd03ce9c105e1a1ec9e49cd3f11e886fb9b677816b29b4c653df5ec6e185a
-
Filesize
1024B
MD5ef2e1694739f7f5e166a013ee8f9273a
SHA1850cd87538f546d687facb5dbf871958ce098007
SHA256c83e08c0083d8e7a022e6e6d34e5ac0477d7e5a329e67f42eb52db71768e679d
SHA512aba085e74593f1cc6ae0a6352cac0fcd1ee5e4a53174f785dbe9275395327f9bcd7752d79000774cba39abd6f332e103f30b3c535f9e8b54920f272e503f6d89
-
Filesize
16B
MD5ec3d19e8e9b05d025cb56c2a98ead8e7
SHA1748532edeb86496c8efe5e2327501d89ec1f13df
SHA256edb7be3ef6098a1e24d0c72bbc6f968dea773951a0dd07b63bad6d9009ae3bf4
SHA512175fb8432472b6795bb5db0eba61bc7b57331720825df5b048f3086815ba844df4f7e83e42ff9e8fe5ab01700675a774cb916677953d6e0088ffbf1fa2775349
-
Filesize
396B
MD5f93e0fb6283b5abbbb7335a0559b37e4
SHA1ead4c3eea9397488519c11743cb80fc252324d20
SHA2560d3c45d19e5e23832b3a633ccf8628dffe8a5dd9a7cd80bc9fbf4d8993f45374
SHA512fa235dcfdfe3968b7c1a15e3fab6d164ad10f232e6e628881a02ba4f580c7f94e0465ee271e72ec00212b13ccabfe7888ae10b4cc1e061f33aa8fa5fccb372c5
-
Filesize
379B
MD573102579f0cc3777bdd0ba96bab8d6f4
SHA108512e731aed9cdfeebf2e8fdc24a35ea23e3477
SHA25603c937a5aba7fd7eab8ae959606ea4598e474da06b7ec63701255e7325a9e435
SHA512e3928e509d852ae8f62b6378f984013345ddff9f5073e77323703acf20ca44bebff1753f09e7343cd948559bcafe766edce38e767efc5e7e7a5fd42c37be2e13
-
Filesize
636B
MD552344902454ff136c92e71b8516da835
SHA1b4a5206dcb9a68b4d366de3fb6ce6d79bf2c2c25
SHA2564d49fa4af7da59b1706c8262352abbd02808cd630c7d0f8957d2dc8f77ef9e1a
SHA512456b90c649a6c08788474074a9bc35196f358bbc037e2462a9f655290f4ebc78bcd4d1072e7978b87fff37e01c9ac6dda3fe111b22eacb81df51eaf1295e57c7
-
Filesize
636B
MD52baa5fed919c4dd5d585834620bad147
SHA1a1e9c84e8f64bb1d92b2d4f6f05665dc7c484f15
SHA2568772f912f920fe676105e73bb4a3966d2df2fb5c3ff7679b36d88864b066fe59
SHA512152146f0396e6f9a615409f025c25fea8a8da19b5260ad05e53184f369fb25b41c02090f10fc94963b57697ef13d6b0bee368a00674e3f071e63537ded1c259c
-
Filesize
8KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
84KB
-
Filesize
760KB
-
Filesize
23.4MB
-
Filesize
23.4MB
-
Filesize
84KB
-
Filesize
8KB
-
Filesize
84KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
84KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
620KB
-
Filesize
8KB
-
Filesize
84KB
-
Filesize
8KB
-
Filesize
620KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
748KB
-
Filesize
760KB
-
Filesize
748KB
-
Filesize
2.0MB
-
Filesize
5.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
748KB
-
Filesize
4KB
-
Filesize
5.1MB
-
Filesize
2.0MB
-
Filesize
748KB
-
Filesize
2.0MB
-
Filesize
748KB
-
Filesize
2.0MB
-
Filesize
2.0MB