Resubmissions

22-11-2024 22:54

241122-2vh7gaxmfl 10

22-11-2024 03:27

241122-dzqkcatmht 10

22-11-2024 03:16

241122-dsgc4atlgs 10

Analysis

  • max time kernel
    93s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 22:54

General

  • Target

    aace43af8d0932a7b01c5b8fb71c8199.exe

  • Size

    2.7MB

  • MD5

    aace43af8d0932a7b01c5b8fb71c8199

  • SHA1

    56422e5cc2abe198198003d2c5bf009c8652a983

  • SHA256

    3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b

  • SHA512

    c4fdee4e0041a98eba661b41f521ea393e2cf8a2683d7722ba198bbc5d7620600855a773c849b1a24fb0542a6fdaf478b4e66d2ca709663d5665fac1613de2b3

  • SSDEEP

    49152:HyhKEGeEWYQAsQ36mE4OZYYIqCGA02Ul0UFi28CdNT0BtT:HygEGTRQAsQ36mE4O6rqCb2i28CdNoBN

Malware Config

Signatures

  • Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aace43af8d0932a7b01c5b8fb71c8199.exe
    "C:\Users\Admin\AppData\Local\Temp\aace43af8d0932a7b01c5b8fb71c8199.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:452
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net use * /DELETE /Y
      2⤵
      • Indicator Removal: Network Share Connection Removal
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Windows\SysWOW64\net.exe
        net use * /DELETE /Y
        3⤵
        • Indicator Removal: Network Share Connection Removal
        • System Location Discovery: System Language Discovery
        PID:2932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads