Analysis
-
max time kernel
112s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20-12-2024 06:25
General
-
Target
2e284063972d9c16b37eba5bf7503f6a79aab6dbc3f26b60627302be448f3897N.exe
-
Size
6.0MB
-
MD5
6b8c0e3bab587b028a11ef1aacc32b90
-
SHA1
4c64932f679115a04005996fe7fec25984952cfb
-
SHA256
2e284063972d9c16b37eba5bf7503f6a79aab6dbc3f26b60627302be448f3897
-
SHA512
1e51f5f8262cabce43cd8176fdcfe78e4c796a2d840f3c6be93af559b8c8572a2496049ced6da0d76a7657d950e63b7c08bdf7254ef07ebd9f688825ad7beeb2
-
SSDEEP
98304:zssvcXkkICDN8PEIvec1K88905+bUs9BAMgFhwvjEt88HoMyj6u2WRJtvT:tvc0khx8PScrkVjhgFhJ4Ksj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 22 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 14 IoCs
-
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e284063972d9c16b37eba5bf7503f6a79aab6dbc3f26b60627302be448f3897N.exe"C:\Users\Admin\AppData\Local\Temp\2e284063972d9c16b37eba5bf7503f6a79aab6dbc3f26b60627302be448f3897N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup DVREMU2 Manager v1.0.0.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup DVREMU2 Manager v1.0.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2P95A.tmp\Setup DVREMU2 Manager v1.0.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-2P95A.tmp\Setup DVREMU2 Manager v1.0.0.tmp" /SL5="$50196,7881415,121344,C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup DVREMU2 Manager v1.0.0.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\TEAM R2R\DVREMU2 Manager\Readme.txt4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Resolveserves.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Resolveserves.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD50de76ea95b6ecf3866d834fa1b078018
SHA169848f81de145ee8f2c5466aa87e6b7278018da7
SHA256632e2772f9536a30dda7e1f61f267ccec1aac7dd5f568260377c0573570a32a8
SHA5121c10ae889dbdad83b9bc135d2c1adc6de988d502624c2a3cf3cc08639bc3f07959a5ccecf4c5dd1a8e1f1581457ebe11a03b06493bc59052d54d967c104e6f6f
-
Filesize
356KB
MD565e470fce7f5a938dabdc824f4a9756d
SHA1da02412280511f8b5ec6978c24c3db9c91af1bc1
SHA256aaea7473d3ab2ec37443981bd9e718cb74cae5d974ce02719aaf02dc3e041633
SHA51213c98751fcd81c346fcdaf7805e58eaaa21fab487c67bd932d103b9513287d29b2f6e7686a3e317d4cb38fde5df18ff9718126744b74b01d180f4ffac803c4f2
-
Filesize
93KB
MD59de67adc52e42f99ec6e8e2efb6c416f
SHA11586fdb1979736e82b96d183d7fee15a53b32226
SHA256f34e2fb573e1eac888496799de3a391e4f5162e250cf4fd93ebab28da4b3b6d8
SHA5122bcc06144cbf682da67573f62c922c9ac4bb15e617a836645e73e059f9a26f4ee03b162ba4c3b655d1911c28493435294928a55af4edfa3e81bdbef2ee4103b1
-
Filesize
102KB
MD52a052d9b7bdd115e24b7bc4b8475edce
SHA12018370cf1cb6e8fdefab2444c086bc98a39e99a
SHA2562083beb78b4ceba4a8fe819ed2307b4c0a22622f32caea60fcea7de0bcbd76b8
SHA51285eab43585c93fcd2456593beca8664f74c22203baab67aac284cf34220be109aa4a7e71da795617d39d7f4a09c68e8452901be3f277a5f73f96661e64812348
-
Filesize
1.2MB
MD5908f64b344bce85c344e88db0c4c334f
SHA1b917238e7bd8176a6bc34664fad61f95bc9b6cb0
SHA2566bdc1c8f0a1bd5951e94f575e6b693d0150d25f3b62bc7314567b2c4c3a8f009
SHA5129e1a4ff4a92f939f9f0ae65b3e23ebfdb1fd2d6d567fc555579abe4ba67221a91585459e017c4565b562ce85f611ff1f2cceec70bb4b74697ed1c06d26e70a0c
-
Filesize
1.5MB
MD516ef27011883d9e9f9ae7e7a871e25be
SHA17f579bada6cb595102dbfb260f0921d46389d697
SHA2566566264df2eed3e76803f4ec9e494a928fda85efe00b8b0a83702fa244fb0a26
SHA51213529f1b13c10a2539a31d7d4df1060d6ff173c34ca7a508f7bf8e8167158509a3dd730e2ea388eff7cbcd99c7fb23a6361818cbb63beafa471e45bcbae9d8ff
-
Filesize
7.9MB
MD5712694288f0a36efead1b9ba8b4c0ab0
SHA1543a71e15c14cb6a080f16aea554ec2f5257d6c7
SHA2568d31d34083335dc0cc3c76bd5f418846e8f4daad5a437cefd8e47df332401b08
SHA512aa73c45724196a4e7b171c403c69b7c84fbe2550e245a6bc8c0c24d4b9f474e5d0d6aef0cbe7aa7d916630c2245161066516055c9567959f01baed093f4c7b65
-
Filesize
2.7MB
MD57b27ce839ce147f86c63f0ae10b0ee27
SHA188f8a898aaf9f6d1ddd33ecb86a9e6b9f5f9d74f
SHA256a2b6c9520fc290f3ac3b170743d06c9131f84d5e448b0c3573638507b1b626ec
SHA51236e024db17ba61d091393bbcdd6a3653d11a89bc702273cc1003a53e3690d60eaeb6421038ba214ac5dc19e2769f37e4831ec4ec9273d14ad15555fb0726b144
-
Filesize
983KB
MD5e19223a1728e37265938696b99a2f740
SHA1d0607aa523de5f562c889734c64dd533baacd37b
SHA256d1d0c1899eb497f8a3d3d2e7b7096ed85176d1cf96f651f24bad0a762a194e90
SHA512555b102c79be2ff55843eb8d1a36c4260145625f5e471ff0e7d0c3f6987773917a949e32b4cb94dbfb8a66c7bf56420f331a791dfe75ed2c3e0675277fa4c94c
-
Filesize
2.0MB
MD5d28fdc37f8ad7a79326752c5cd8ffa0c
SHA123956581ba8055419300ebe46daaaedf46ca0bfa
SHA2567ca8142b91c84285116f8d57f57d9f6d9b06e96c933d5f0fb8f3b2180363ffb8
SHA512eacd56b203483e8e0ad6b026df035811a7f104c788a33835a35709fc3e541e960226399cef60793a0113461f86b6cd87e367023f27f688608b83e93383e2b6a1
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
4KB
MD55df8ada84a16f5dfc24096ef90a5ce3a
SHA15e7e9c68119c3a0a1afc92c60674bc8714492823
SHA25648a9c8c332fde541b571d9d522d0e37834b452f55af8cbdc341b12222e78fb5b
SHA512661b5219c74dd6e3a8e899a1b1a3002689d148e337d7323a174519366c9548c284ee76e2faa2f9600cd483db21093ee62399f0d7403c39523c654266760191c2
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
160KB
-
Filesize
68KB
-
Filesize
72KB
-
Filesize
76KB
-
Filesize
200KB
-
Filesize
168KB
-
Filesize
12.3MB
-
Filesize
980KB
-
Filesize
388KB
-
Filesize
572KB
-
Filesize
36KB
-
Filesize
1.4MB
-
Filesize
1.6MB
-
Filesize
640KB
-
Filesize
348KB
-
Filesize
1.6MB
-
Filesize
492KB
-
Filesize
12.3MB
-
Filesize
92KB
-
Filesize
1.1MB
-
Filesize
224KB
-
Filesize
524KB
-
Filesize
200KB
-
Filesize
980KB
-
Filesize
348KB
-
Filesize
1.6MB
-
Filesize
1.1MB
-
Filesize
628KB
-
Filesize
1.6MB
-
Filesize
980KB
-
Filesize
228KB
-
Filesize
200KB
-
Filesize
560KB
-
Filesize
524KB
-
Filesize
348KB
-
Filesize
560KB
-
Filesize
492KB
-
Filesize
1.6MB
-
Filesize
640KB
-
Filesize
572KB
-
Filesize
388KB
-
Filesize
216KB
-
Filesize
228KB
-
Filesize
388KB
-
Filesize
1.6MB
-
Filesize
228KB
-
Filesize
980KB
-
Filesize
200KB
-
Filesize
560KB
-
Filesize
1.6MB
-
Filesize
388KB
-
Filesize
216KB
-
Filesize
524KB
-
Filesize
72KB
-
Filesize
36KB
-
Filesize
640KB
-
Filesize
156KB
-
Filesize
224KB
-
Filesize
628KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
348KB
-
Filesize
640KB
-
Filesize
1.4MB
-
Filesize
572KB
-
Filesize
388KB
-
Filesize
1.2MB