Analysis

  • max time kernel
    112s
  • max time network
    116s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2025, 06:22

General

  • Target

    c49f8fea6230da9d810dddff886709c32714ee367ed5e862194e4c33b8f7af9c.exe

  • Size

    2.3MB

  • MD5

    6ecfb7154353d367c99380f9c8ea188a

  • SHA1

    61a862ee7812c636f7f9557afe3216b77afcf335

  • SHA256

    c49f8fea6230da9d810dddff886709c32714ee367ed5e862194e4c33b8f7af9c

  • SHA512

    17de1c67b751778b8f40fce84a5d379c207495aaf70c91bac92dd1f051e1c2f84dadda518f996827b3a723f13933454c04eb9340be4713e23cc547521c1c053b

  • SSDEEP

    24576:x1r43sfARB7U4kieI1SqjEDKcSrJIvJiu/AxWtS:Pr43o67TrXIqjbcS6vJT6WtS

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c49f8fea6230da9d810dddff886709c32714ee367ed5e862194e4c33b8f7af9c.exe
    "C:\Users\Admin\AppData\Local\Temp\c49f8fea6230da9d810dddff886709c32714ee367ed5e862194e4c33b8f7af9c.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Users\Admin\AppData\Roaming\ProcessorDistrict\ComputerBalance.exe
      "C:\Users\Admin\AppData\Roaming\ProcessorDistrict\ComputerBalance.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

    Filesize

    5B

    MD5

    5bfa51f3a417b98e7443eca90fc94703

    SHA1

    8c015d80b8a23f780bdd215dc842b0f5551f63bd

    SHA256

    bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

    SHA512

    4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F

    Filesize

    834B

    MD5

    5cb16e48b582bf86a4b396fcbc235981

    SHA1

    3e7cbf189fbbff1efb9b04c398ceb902e816f15b

    SHA256

    ba479af493eeefdf7de4c86890f5d87886bc0bc92522d39dd09eb21f85cf23f9

    SHA512

    55210eb21fd974bb189063d4e377c37b2cf1c2e0d7ec056dee48f8619cfe04a7a8c1ba329abcfa7edb4785fac08375df4c8261e98dc3a8294f0f4fc29cf61eee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A89DFCC31C360BA5CBD616749B1B1C5D

    Filesize

    62KB

    MD5

    199e73235b6d6b00903230175aa804f8

    SHA1

    89b31508fab11a1569fd36274606a01fe278522c

    SHA256

    b548234cd8d9aefb6670ac25f1bd03a6fb43b62aa8e5cfe36143205884c646d8

    SHA512

    5b645a88384d9ed035cc6d7a6db75a859cc260d9e766196cbde03b3fb821c46501d3112602cf10277734d0b921e4c2389b983280998322206beaac54ff51bd33

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

    Filesize

    404B

    MD5

    25389ae305a64d589b993cad17ff193b

    SHA1

    84849a24c0beb22544d1db797ba253fde13eae45

    SHA256

    1a8ba06c3bfacb083efbc4bc5f007c9118f90be89c14214da4092893e66e5688

    SHA512

    433321230dcdcb769fa761a621db6999f10de6e4cf96680c61f8989568c28d5b66e96da5146a3b2a55837affb118e3cbd39e48e51dd2086b1816d373fdf9cd9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F

    Filesize

    188B

    MD5

    266c6342ab7b8ef7bf9f5ac9c5122691

    SHA1

    296362627cdc3965bfbfe6a9dd54329c2d33bf24

    SHA256

    0ac9185b650a6cf3c11243273a58a7d3a9b4f8133ac3bb27d84c24d363a563ea

    SHA512

    c654243bd70ee449b2b6e0b5ff192057351e99891ff6a5a8b0c9a99f580dd6a6959462f8287125c87a9e4c25df4c78338cad4f49d071fd7c8aef22fd922c8869

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    17243c3b4a111c0a40fd0ed5599b4f87

    SHA1

    965cb1c325f91ac3e6b532556b4a156cd33b3997

    SHA256

    9d27fdc44b7f7c45e23fa9ab898aca2d77f319ce61b5b103750cb6785a688781

    SHA512

    4ef0761ff0ce1702e63567b87babbf87136ad12c95a6c2b34b1109462945592f6a51d4c873e4bd2971ae57a63008da0671e2432bb5301867226ccdbba291500a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b12018d9734c4943ccaf82c28f3bf5da

    SHA1

    4c011188e77fb2223c5e63e1ef4a9dee7a6cb61b

    SHA256

    e8dde2f001e55c7e41fcad96b1e766216d4724b7f7b66618bf0f9b2f83004e31

    SHA512

    736f25a3b1049938afeb7b5dd169a99b145c6574ee0f419dd8925c581cd95f84ba00745b1d73a8d7ff0ab26747bd8a87e18c4d673e912772b8b82beba5795792

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9A19ADAD9D098E039450ABBEDD5616EB_EB45958463869A839B2E6A0ABE8A149F

    Filesize

    394B

    MD5

    0ca84b5bfa90062c4b5460c95ef86aca

    SHA1

    3af926cf6357c2a36f42cd2e4a2c1c283920118c

    SHA256

    0c6b655aa59b413450cd5012dd6da5a422d788d2c902b216af153e2c69d6379f

    SHA512

    35a857cf551f6b628b05ff250f0fa50a16c6969e4b7cd91a6f6290e3f4bd82ed12db24b2860cb85db2193f0c37e95fc088f089423236d8c08cf39b524b279dd5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A89DFCC31C360BA5CBD616749B1B1C5D

    Filesize

    170B

    MD5

    5e20f196939d01018657e481c316b5a7

    SHA1

    072818c5b4bf069564c338b9e4917ad80fbe841c

    SHA256

    2d6c96e42c7c259ca55311599b5d4dbf9ec8c5422e46e5f4d1c3422e92b759cb

    SHA512

    3625e85bfa5df040302e11bd5aab908c32c8c42748407c1e49531c471a1c316564702fc5e9f57d0e7f02f5877d38695d644b2aca90c0642e526594a479b4eda0

  • C:\Users\Admin\AppData\Local\Temp\Cab61B.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar65C.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Roaming\ProcessorDistrict\ComputerBalance.exe

    Filesize

    2.3MB

    MD5

    204deb8edd575412a80114cb93823d90

    SHA1

    a6df439d0dad7626b0354629cd3c0e33c70c82bf

    SHA256

    724bd9e21c945c73f5e3170b748acd302d60c5a8030a0c6c28677f1114510039

    SHA512

    7c2d0e097c3b2bc270bffcc1effbb7b85fb7492fa7f1e58db6f732dc6f76344f8ac3a1058f2765cfc8daa860982c2f4c01d567a2f42c9efc742754e8a26ea7fb

  • memory/1512-121-0x0000000074440000-0x00000000749EB000-memory.dmp

    Filesize

    5.7MB

  • memory/1512-132-0x0000000074440000-0x00000000749EB000-memory.dmp

    Filesize

    5.7MB

  • memory/1512-123-0x0000000074440000-0x00000000749EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2808-122-0x0000000074440000-0x00000000749EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2808-0-0x0000000074441000-0x0000000074442000-memory.dmp

    Filesize

    4KB

  • memory/2808-2-0x0000000074440000-0x00000000749EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2808-1-0x0000000074440000-0x00000000749EB000-memory.dmp

    Filesize

    5.7MB