Analysis

  • max time kernel
    120s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2024 16:28

General

  • Target

    b70b5f1f0ae005ccec07d2ac8828a4599996c9c6db5ea4a02b5788ba9c62733cN.exe

  • Size

    77KB

  • MD5

    da281771cecfa1052e1e25410d0672c0

  • SHA1

    e7dd17932673d9396eae8ecf55aa3ed33692e3bd

  • SHA256

    b70b5f1f0ae005ccec07d2ac8828a4599996c9c6db5ea4a02b5788ba9c62733c

  • SHA512

    798993a70638ef3484b5697db5a1797611a6cc8952e72eca1fcb8ca1f8a2d3583d30514ea25bacf9349593c8ea849eacca00b9be9622da1c2e8723d95d31e54c

  • SSDEEP

    1536:sJe+2wvFDp1S5wpOk3JCK6pFotfd6fOpd/9nEh9TGjJ3R:2QwpOk5CK6XO/9ESjJ3

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b70b5f1f0ae005ccec07d2ac8828a4599996c9c6db5ea4a02b5788ba9c62733cN.exe
    "C:\Users\Admin\AppData\Local\Temp\b70b5f1f0ae005ccec07d2ac8828a4599996c9c6db5ea4a02b5788ba9c62733cN.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3212-0-0x00000000752E2000-0x00000000752E3000-memory.dmp

    Filesize

    4KB

  • memory/3212-1-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-2-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-4-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-3-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-5-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-6-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-7-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-8-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-9-0x00000000752E2000-0x00000000752E3000-memory.dmp

    Filesize

    4KB

  • memory/3212-10-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-11-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-12-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-13-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-14-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-15-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-17-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-16-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-18-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-19-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-20-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-21-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-23-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-24-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-25-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-26-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-27-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-28-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-30-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-29-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-31-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-32-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-33-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-34-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-35-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-36-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-37-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-38-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-39-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-40-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-41-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-42-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-43-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-44-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB

  • memory/3212-45-0x00000000752E0000-0x0000000075891000-memory.dmp

    Filesize

    5.7MB