Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:16
General
-
Target
c15177ea36f2afdbf176de2a137587ea.exe
-
Size
26KB
-
MD5
c15177ea36f2afdbf176de2a137587ea
-
SHA1
7dd50ee8fc28cf47c6aec26a329f96bca30ef66b
-
SHA256
c886a602a924661c74be26d1f1123c152702f13126982dda2cde9f2cfee867a8
-
SHA512
2acaffef03688a4b8382d336876323fcac6a06bda4a2b3235572d41e65800ccee80d747e7059185a4e5c28168263e61eb9f3093980c12661d34c7fa572df77a2
-
SSDEEP
384:pLqW8nO4V7ngiJMroU9SPYiGGMdAQk93vmhm7UMKmIEecKdbXTzm9bVhcaA26KrZ:ZhVMgiOjdA/vMHTi9bDA
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c15177ea36f2afdbf176de2a137587ea.exe"C:\Users\Admin\AppData\Local\Temp\c15177ea36f2afdbf176de2a137587ea.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\LoL Checker.exe"C:\Users\Admin\AppData\Roaming\LoL Checker.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\LoL Checker.exe"2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD5c15177ea36f2afdbf176de2a137587ea
SHA17dd50ee8fc28cf47c6aec26a329f96bca30ef66b
SHA256c886a602a924661c74be26d1f1123c152702f13126982dda2cde9f2cfee867a8
SHA5122acaffef03688a4b8382d336876323fcac6a06bda4a2b3235572d41e65800ccee80d747e7059185a4e5c28168263e61eb9f3093980c12661d34c7fa572df77a2
-
Filesize
1KB
MD591d10277968b4ffdfe31a36b85ffadd9
SHA1609d88154b6a9589ed0299d035eff5da6e12122c
SHA256a24d59715d94649af044b9c086e33feafdfbaa12df36efe3d503e5d843f5cda8
SHA512436ec7817ca516b4ece2febe0d09ca6b892430be6fb32f804c5d6b8640b2f702f7207e49543da983ec0e6ba1a759329b0d8b81643ae3386a287de3ece7b2760f
-
Filesize
1KB
MD55fe8cb8df3ae82e643543f47372e3019
SHA1e9e7e6a39cd289393e9bd0eeb185e9b31e821f62
SHA256aaff30e818f01b715d1943241f636f15f9d5b46a651da0d87a1ac8711103115d
SHA5123f7efa8b049ccf3f0353c7185fe98b81d094e5911515818a9a1a7a936c89ba63857f0755f0f31fc0dd985c7f682d3d77d4f9e02941cf238d54a8ad62766f7998
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB