Analysis
-
max time kernel
119s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/11/2024, 10:30
General
-
Target
bce4cf5e303d78c169f38ad8703c203308251f507819ec813cf50144f5df7a31.exe
-
Size
285KB
-
MD5
ed3e26661788d803bbf0673eedabc5d7
-
SHA1
a384f32e47cff47733ad14331137623a5b6a9c28
-
SHA256
bce4cf5e303d78c169f38ad8703c203308251f507819ec813cf50144f5df7a31
-
SHA512
e69fb2f45c601672c39230bb3a3c3ccadd691ed3d5fa097ba979dcaec72a2afb45bab46a84bfb593a4f49374a662893c6f13f0d82773b2bf47b727e46ad54665
-
SSDEEP
6144:W1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe/ZVMXTA:WjkArEN249AyE/rbaMct4bO2/F
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bce4cf5e303d78c169f38ad8703c203308251f507819ec813cf50144f5df7a31.exe"C:\Users\Admin\AppData\Local\Temp\bce4cf5e303d78c169f38ad8703c203308251f507819ec813cf50144f5df7a31.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Managemenot\Monitor\tcpscrex.exe"C:\Program Files\Managemenot\Monitor\tcpscrex.exe" 0.0.0.02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
285KB
MD5bc2e95250a1b4a146d77f0767508eb63
SHA1fc84a4be38fb4a524ca5569ccce43b35028f24e2
SHA256f6bc0c29e4998f0bb28cbf717734dd14c75a005e482bc2c47c9aad1f8efbac32
SHA51221a6ad784c92726d3348cda63ae281f94caeec053436518e518b290bb852520a52783bf6dd0534857ddd0b26bbd096e33591dd6d9485a356fc6386c54c657e27
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB