Overview

overview

10

Static

static

3

e221e43839...3N.exe

windows7-x64

10

e221e43839...3N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-01-2025 06:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e221e438393ee641406d919d43a4eb3205644ae31f35713c059f688bc2ebe3f3N.exe

  • Size

    135KB

  • MD5

    4378eac179cc19e0d57d83c5f7bd2b80

  • SHA1

    48eb8741f6081b2f01f69d04ca422cd0075d7bc6

  • SHA256

    e221e438393ee641406d919d43a4eb3205644ae31f35713c059f688bc2ebe3f3

  • SHA512

    09315720b50c653b3027b9e8815d6252745c856b54a0ced4f5f1d5cc46f2cc457175734c01c5d5234e90c061ef3cf100926314c0d694622c835add5407c5b1ca

  • SSDEEP

    1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgwFTlI:XVqoCl/YgjxEufVU0TbTyDDalbI

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e221e438393ee641406d919d43a4eb3205644ae31f35713c059f688bc2ebe3f3N.exe
    "C:\Users\Admin\AppData\Local\Temp\e221e438393ee641406d919d43a4eb3205644ae31f35713c059f688bc2ebe3f3N.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4600
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4124
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3748
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3268
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\Themes\explorer.exe
    Filesize

    135KB

    MD5

    0ef47f3de7a6cb3eccfe641bdcc7d49b

    SHA1

    4c3ff08788777e683f51b6f85429074a2f46c7f5

    SHA256

    fb32a5d00e95e0f97c2a878d31bb7234ddb1c2a01182edd7034bc63f81fab57d

    SHA512

    bac850edcd89dede3d1dd7067b5605a93151e1e38a8c30e2f213d79c4139c5c13077a190c57975ec7422ba4d8aeac6b908b9b825cf21ded34f75134005fed537

    Download Submit

  • C:\Windows\Resources\spoolsv.exe
    Filesize

    135KB

    MD5

    39858d1f0d3ebbe39ab020c2f3e1c1da

    SHA1

    6c15cf15f21dc788053652989034a8e09bdae4c3

    SHA256

    42c2c3cdadf1008a4b5c95e245a19e0acbe20e53459f70bd50142f21173266ab

    SHA512

    f3ccd2a5851f31ebce3d83d88b0cd908440e127d42d47ab54a1d270be4b02c0b3128eda13d9454144d0423538b3ce7f353256a6203b3987b047e03b0a89732d4

    Download Submit

  • C:\Windows\Resources\svchost.exe
    Filesize

    135KB

    MD5

    f902a54ae3180f41bd3104699abf519f

    SHA1

    6aaeaabee2cb1e4e341b6d6c83d14e782a2b71fe

    SHA256

    128a71d4b33d25eff44a07d8a17dc6c22961f5afc9db97227258585d52fe677a

    SHA512

    b3638188936bcc44c5a4b7c716b88c87c9cf38951e1654b0ad5ff2e230cb35c97fc789ddaf63b24610d59a88c50a60aa36f7566179f57e912fc3749b77f445df

    Download Submit

  • memory/3268-36-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3748-33-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4124-35-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4600-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4600-34-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4828-32-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download