Analysis

  • max time kernel
    101s
  • max time network
    131s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/05/2025, 09:14

General

  • Target

    transfer request_Al Ansari Exchange L.L.C............exe

  • Size

    931KB

  • MD5

    31af0de64c935256bee98bf15d30e0f1

  • SHA1

    dedfd40bc98234052a1f6cf4c9edaedb9d97d098

  • SHA256

    bd9d4a2d5627b27b2e43afd37b07ce6c6b2d64a7017def2020c2c1434eae1a2a

  • SHA512

    e0cb0916081f96d6b291a39dcde0b3a32b16ccd335034185e899efd74276029ceffdfc2a640f526ff5da6ebd2c9c56ff4dec4dd7cdf9872a0e59dc4d89815c3e

  • SSDEEP

    24576:QbnGASXscW+TSlT0UJdqSjL5befSiH43:knNSXQ+mF0iqasfSH3

Score
10/10

Malware Config

Signatures

  • Detects Mofksys worm 3 IoCs
  • Mofksys

    Mofksys is a worm written in VisualBasic.

  • Mofksys family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\transfer request_Al Ansari Exchange L.L.C............exe
    "C:\Users\Admin\AppData\Local\Temp\transfer request_Al Ansari Exchange L.L.C............exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5144
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3892

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3892-12-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/3892-20-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/3892-14-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/5144-4-0x0000000005670000-0x00000000059C7000-memory.dmp

          Filesize

          3.3MB

        • memory/5144-0-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

          Filesize

          4KB

        • memory/5144-5-0x00000000059D0000-0x00000000059DA000-memory.dmp

          Filesize

          40KB

        • memory/5144-6-0x0000000074B70000-0x0000000075321000-memory.dmp

          Filesize

          7.7MB

        • memory/5144-7-0x0000000005C00000-0x0000000005C16000-memory.dmp

          Filesize

          88KB

        • memory/5144-8-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

          Filesize

          4KB

        • memory/5144-9-0x0000000074B70000-0x0000000075321000-memory.dmp

          Filesize

          7.7MB

        • memory/5144-10-0x0000000006D10000-0x0000000006DE4000-memory.dmp

          Filesize

          848KB

        • memory/5144-11-0x000000000A800000-0x000000000A89C000-memory.dmp

          Filesize

          624KB

        • memory/5144-3-0x0000000005570000-0x0000000005602000-memory.dmp

          Filesize

          584KB

        • memory/5144-2-0x0000000005C20000-0x00000000061C6000-memory.dmp

          Filesize

          5.6MB

        • memory/5144-19-0x0000000074B70000-0x0000000075321000-memory.dmp

          Filesize

          7.7MB

        • memory/5144-1-0x0000000000B30000-0x0000000000C20000-memory.dmp

          Filesize

          960KB