Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-01-2025 18:47
General
-
Target
d82f9b6bf20b0c9f1a1bb556275d7b7a23544136672f51bdbe19ce4f70cd2e87.exe
-
Size
3.2MB
-
MD5
17aa63a6b2374f655509ccf20a716b66
-
SHA1
4bc36e5e10d3437fd3cf00c0f43a3c77246c7bd4
-
SHA256
d82f9b6bf20b0c9f1a1bb556275d7b7a23544136672f51bdbe19ce4f70cd2e87
-
SHA512
753eb6bdd1bba70fd6c3536dd720820bb5fb6e9eb11746533dced21e5974fd3962b7423fcd2379212847a0853359ec531f694d9dde2b4c0a9096c503c3e96422
-
SSDEEP
98304:ZsBzPpbyP3yujSOGrmXD7IIuo1kkIQgtci:qhbM3yOSzQvIIuoxgth
Malware Config
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d82f9b6bf20b0c9f1a1bb556275d7b7a23544136672f51bdbe19ce4f70cd2e87.exe"C:\Users\Admin\AppData\Local\Temp\d82f9b6bf20b0c9f1a1bb556275d7b7a23544136672f51bdbe19ce4f70cd2e87.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe"2⤵
- Enumerates VirtualBox registry keys
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
628KB
MD551c3f33163cb118d7cd1506648d8ea69
SHA12f37ac854cea300577e6de102e1c699a87f2178d
SHA25692a5600741e66bba6153e2b536781416080e5338d703c2de8deb13ee4788dad8
SHA5124816cd986a5f423ebdabb11230437f12394433e69c0bda9e99a0028fcf04ff68db10941ffcca7a6db24e850f3f55b0e81c4df9edc2ba31d204d5925c8a636a3f
-
Filesize
7.5MB
MD501c91b18bb9f718a369b0f08e8eadcaa
SHA1a4fab291130875950ecc0f58dcc7744c3e7181cf
SHA2567da575062afcd38a4c475e7e921a1f2373e3a04752ed184a0dc3b91eb3752a1f
SHA5126bac4a871c2a7a6b7f90a4cd76cbca08fd31d4de92f69328725d7d70f8a44ad3cffdc787abf54f996a9e3b14638049469d70f9feac9e2b6cb497e7f866841564
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
648KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
10.8MB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
992KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
304KB
-
Filesize
344KB
-
Filesize
10.8MB
-
Filesize
8KB