Analysis

  • max time kernel
    100s
  • max time network
    210s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    06-12-2024 10:38

General

  • Target

    Trojan/Mist/MistInfected_newest.exe

  • Size

    22KB

  • MD5

    1e527b9018e98351782da198e9b030dc

  • SHA1

    647122775c704548a460d6d4a2e2ff0f2390a506

  • SHA256

    5f7471c215b433f1b28dd4b328b99362099b6df7cb9e5c1d86a756388e0c7aeb

  • SHA512

    4a11c811f30016218075d43a9f983fa7a484a06f22d625b1bd2d92b4cfabbfb142945ca0a9ca1cf91391a3e73c154f6121140d2f1d42aa35ad7f10817534a21b

  • SSDEEP

    384:qosO55gUoO4D+DFBCd6GyhETw62O0OnYPL3p+:XsOkUoO4Dsbc22

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan\Mist\MistInfected_newest.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan\Mist\MistInfected_newest.exe"
    1⤵
    • Drops file in Drivers directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Users\Admin\AppData\Local\Temp\MistInfected_newest.exe
      "C:\Users\Admin\AppData\Local\Temp\MistInfected_newest.exe"C:\Users\Admin\AppData\Local\Temp\Trojan\Mist\MistInfected_newest.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MistInfected_newest.exe

    Filesize

    3KB

    MD5

    459f3d7499adf6570cd98bbc2635f74c

    SHA1

    e2f1ffe536315c83e65d099e84c1ec8728bbee85

    SHA256

    5c5ecc47ad85aadb5acf9d057461073ec37c9407510379dd16985284b821cda7

    SHA512

    748b9ef6c075036d6cda5840864e10b92fad80416578b51e37a0e7a01ddac1b80f2af192897e2e68b023904ac7f2f2bd17c5840161c51ac09e551f4641520490