Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 13:52 UTC
Static task
static1
Behavioral task
behavioral1
Sample
e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe
Resource
win7-20240903-en
General
-
Target
e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe
-
Size
971KB
-
MD5
2f483b8b5b15e945811467511ebc3af0
-
SHA1
7b7bbbcefe291db7f243124ca840ce5c54a8e646
-
SHA256
e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023
-
SHA512
400b1c5cc6e39f6a79e8fdc0b8cfe91f1b27c1c83619795aba73929707371498b999085cc1a69cea8ae13a212100be44fe6cc307d69644aa9c746636d5da033e
-
SSDEEP
24576:TMjrW64T8eVpJ5V5N/7flrXyCBQR80FBmjRLrEH7p:Qjy64X31drPQR80FkjR8
Malware Config
Signatures
-
Floxif family
-
Detects Floxif payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023c7b-1.dat floxif -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a000000023c7b-1.dat acprotect -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation DriverPackNotifier.exe -
Executes dropped EXE 1 IoCs
pid Process 5056 DriverPackNotifier.exe -
Loads dropped DLL 1 IoCs
pid Process 2160 e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe -
resource yara_rule behavioral2/files/0x000a000000023c7b-1.dat upx behavioral2/memory/2160-4-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2160-79-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\notifier\64.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-danger.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-fire.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-success.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-usb.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-danger.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-fire.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\Icon.ico e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\Uninstall.exe e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\wget.exe e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\blank.gif e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\notifier\64.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\drp.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-battery-failure.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-tool.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\run.hta e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files\Common Files\System\symsrv.dll e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\loading.gif e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\close.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\file-icon.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-battery.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\run.hta e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\main.js e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\Uninstall.exe e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\blank.gif e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-celcium.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-chipset.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\notifier\notifier.hta e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\notifier\notification.js e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\wget.exe e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\drp.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-celcium.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-security.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\Icon.ico e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\main.js e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-security.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-tool.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\DriverPackNotifier.exe e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\notifier e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-ram.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\DriverPackNotifier.exe e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-cooler.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-usb.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\notifier\notifier.hta e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-phone.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-chipset.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-cooler.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\loading.gif e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-success.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\close.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-battery-failure.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-battery.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-harddrive.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-phone.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-tip.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-tip.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\notifier\notification.js e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File opened for modification C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\file-icon.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-harddrive.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe File created C:\Program Files (x86)\DriverPack Notifier\bin\Tools\icons\gliph-ram.png e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DriverPackNotifier.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2160 e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2160 wrote to memory of 5056 2160 e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe 82 PID 2160 wrote to memory of 5056 2160 e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe 82 PID 2160 wrote to memory of 5056 2160 e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe 82 PID 5056 wrote to memory of 2520 5056 DriverPackNotifier.exe 83 PID 5056 wrote to memory of 2520 5056 DriverPackNotifier.exe 83 PID 5056 wrote to memory of 2520 5056 DriverPackNotifier.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe"C:\Users\Admin\AppData\Local\Temp\e6712ae2ce83ee6067944d8f7036a0c9e700b5336e1877801ed4fc4ef9484023N.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Program Files (x86)\DriverPack Notifier\DriverPackNotifier.exe"C:\Program Files (x86)\DriverPack Notifier\DriverPackNotifier.exe" "--install"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Program Files (x86)\DriverPack Notifier\bin\Tools\run.hta" "--install"3⤵
- System Location Discovery: System Language Discovery
PID:2520
-
-
Network
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request75.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request7.98.51.23.in-addr.arpaIN PTRResponse7.98.51.23.in-addr.arpaIN PTRa23-51-98-7deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request181.129.81.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request22.236.111.52.in-addr.arpaIN PTRResponse
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
75.159.190.20.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
7.98.51.23.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
197.87.175.4.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
181.129.81.91.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
22.236.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5d663176b9297a432309140315169274c
SHA10f49833354b2b172491d8a32fd70c2bb35ae0535
SHA2560659388dba26d26eada6d82ed38f22fb2b0a264d1cc4667cce7f4523c72d59be
SHA512390372fba7408330c41db3c63b89ac67160c81e0f3e4cd9ec5ba656b41152bf48bd7b6c1a62b6c117ea3982da2d8c7e48b676da0f264f7c6887c8d8fc7e61878
-
Filesize
487KB
MD5e4ab7f55bbef378fcd8903558584c7d3
SHA1bd776e0e11af900c073efe0bc6c529a9d4c4f020
SHA256c3e8f94143457535545c31e53eeef15c57ff3c35a12e97b2abab79a26585d509
SHA51212bcc95f60296f4fb16c0e46c047fd4aab27d8c8bfd3e42fb2f6cd9c2611c67bce33909b9165c41c02a2ad023123b8c2bbd98a1502675e50a15cdf7abfad894a
-
Filesize
1KB
MD5107923a95de7b0358ffaa9346fac5739
SHA1d7744f47121bdd3352291aae69caf6ccf5c612c3
SHA256d954416c767ae944ecd3b17241e9921ac6d9336ab373b456b0480e54dcc093dc
SHA512dea56713bab30ce2cf6e95488919056c529bedd494c3fa04124d144d09a1c15f6b69e8811ea04b86b52cfc8dae4600605d69c771f6b4fcb2a018cf902eee0e1a
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab