Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 11:17

General

  • Target

    ebeba6ca66f2de14808fce8857b8e2f5b4bdcf4537c032c97093e761d27ac4f3.exe

  • Size

    50KB

  • MD5

    97db809e825cee055d3e79a0bd937fff

  • SHA1

    96b6e7fdf0c6dc32b8deb0711f888ee7bb0dbb06

  • SHA256

    ebeba6ca66f2de14808fce8857b8e2f5b4bdcf4537c032c97093e761d27ac4f3

  • SHA512

    87f9350f3533c05110e073ce21b1f6c85941ac91da3ea032198888f7be465285b404f78dc83e1e071ffa5808821674278226823f049f92d88596733ef19450f5

  • SSDEEP

    1536:SxGPLTFI0GCfUQv+xhWylmBaqFsJC5F5BzXUnwzjx/u1bmtlokMfGXf:tPLRIQU+qhwFD

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebeba6ca66f2de14808fce8857b8e2f5b4bdcf4537c032c97093e761d27ac4f3.exe
    "C:\Users\Admin\AppData\Local\Temp\ebeba6ca66f2de14808fce8857b8e2f5b4bdcf4537c032c97093e761d27ac4f3.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\Admin.exe

    Filesize

    50KB

    MD5

    80e2f4f9564859faccee9c92fc23dca2

    SHA1

    21e70bb1fdac3d5e8deaf8fca1ac82c4aad47497

    SHA256

    2749bcdd0bbe4b239b4cac75945498282134221b362f0697deac6fee9a95c870

    SHA512

    53b4d5fec662acaf5b7f8a8a18aa1adee03edf1c9518e3781d3baf4cd7206ce8b2127ec48a20a6e0894a31b52ff8b5e200bb996c6d5691da8abe41d51557643c

  • memory/988-16-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/988-22-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2688-0-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2688-1-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2688-13-0x0000000003750000-0x0000000003768000-memory.dmp

    Filesize

    96KB

  • memory/2688-14-0x0000000003750000-0x0000000003768000-memory.dmp

    Filesize

    96KB

  • memory/2688-20-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2688-21-0x0000000003750000-0x0000000003768000-memory.dmp

    Filesize

    96KB