Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/11/2024, 15:24 UTC
General
-
Target
da0d0e8f44c2bc071bfcf2d7d39be0d79647bf144d6096f2f70cc3a7d4143a78.exe
-
Size
48KB
-
MD5
c137b03e06b77c84fa7230c05ee51e7c
-
SHA1
50f746bf3eda1625b212f84ad2fb276c4960bd64
-
SHA256
da0d0e8f44c2bc071bfcf2d7d39be0d79647bf144d6096f2f70cc3a7d4143a78
-
SHA512
663f5c53ba3cd4ea57defb3fc8f406b145b363bb2f8056f0e3c838eafcbad3d597ee6d9aaf2a3cef7a3fcce8b57d19aa6f5fc2924f4971080424381c81c496b3
-
SSDEEP
768:q7GN0XTTPVqKKKKKKKKKKKKKKKKKKKKKKKKnKKKKKKo1QeGTwK0NHXsH6bJCYhx1:q7t/OHTwKqWAxcpvcqu74+JT
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\da0d0e8f44c2bc071bfcf2d7d39be0d79647bf144d6096f2f70cc3a7d4143a78.exe"C:\Users\Admin\AppData\Local\Temp\da0d0e8f44c2bc071bfcf2d7d39be0d79647bf144d6096f2f70cc3a7d4143a78.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
-
DNSns1.theimageparlour.netRemote address:8.8.8.8:53Requestns1.theimageparlour.netIN AResponsens1.theimageparlour.netIN A206.189.185.75
-
206.189.185.75:8000ns1.theimageparlour.net
-
8.8.8.8:53ns1.theimageparlour.netdns
DNS Request
ns1.theimageparlour.net
DNS Response
206.189.185.75
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD509cde0a8af3c44e0ce59f7df61899f02
SHA1fecf71e4289dcf0788e8ae315257d7f1ef0cfe24
SHA25648fef3d839e1de1c541d8ed9649ed4892fdb11df7ab418c636848ed88aba2059
SHA512b7814bb15ba92c12de9f171d5d956e4c3900b7c9464f5bc2089f3749ead84c9a18baf0af22fff68fbb0d4590073f5950dd3bfa9d27dab5896288b94dcbbf5c54
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB