Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-01-2025 23:18
General
-
Target
7183539154ffe5530e1bb32e7d166f8190411eb1656a0b1e562cfd96d40d748a.exe
-
Size
3.2MB
-
MD5
cd34a1a803a778d0b6f7524a7175facb
-
SHA1
82c802f468c0acd8cfde56ad601e4359e1607d65
-
SHA256
7183539154ffe5530e1bb32e7d166f8190411eb1656a0b1e562cfd96d40d748a
-
SHA512
ca865037abe2c30b0cae4be544ed247148069e9450be9813f85423d625791885e2a62820f9f0391c4580fb89ca179b15a13e689a84fc6bc83df0a0c8b7b4835b
-
SSDEEP
49152:ZsvnQtzPIM6eHVGJqvosvKp+sU0OlVaDkZMqSGHBIHEZf9XHNPYROzgFMpl:ZsezPpb1ngsv++rTnVZMqSGaof932Rql
Malware Config
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7183539154ffe5530e1bb32e7d166f8190411eb1656a0b1e562cfd96d40d748a.exe"C:\Users\Admin\AppData\Local\Temp\7183539154ffe5530e1bb32e7d166f8190411eb1656a0b1e562cfd96d40d748a.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe"2⤵
- Enumerates VirtualBox registry keys
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
628KB
MD551c3f33163cb118d7cd1506648d8ea69
SHA12f37ac854cea300577e6de102e1c699a87f2178d
SHA25692a5600741e66bba6153e2b536781416080e5338d703c2de8deb13ee4788dad8
SHA5124816cd986a5f423ebdabb11230437f12394433e69c0bda9e99a0028fcf04ff68db10941ffcca7a6db24e850f3f55b0e81c4df9edc2ba31d204d5925c8a636a3f
-
Filesize
6.9MB
MD5b42becf3d958994cc69b5f9914201451
SHA1d35399e54df78949f3aec572182b404b3d81c223
SHA256e56a7544513f82d2c1c6d8770ce9a6357bacb06d39b63034a597c76a752d7ba7
SHA512c37310f0c55776eba00a7e0d99d8958c47e1579c8c225d4c3fa726eaaf9b123159be1537e087b9d297735f92c600d7a38ba5dbd175407f6246ae6ddfabcd2d3b
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
10.8MB
-
Filesize
648KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
992KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
304KB
-
Filesize
344KB
-
Filesize
10.8MB
-
Filesize
8KB