Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2025, 19:23

General

  • Target

    ddd835d3fc050621ef6dd4468ab68d8898f72f68dbb86c07526a54170592bab8.exe

  • Size

    448KB

  • MD5

    3f519b2622645c2ae35bec5ca08e154e

  • SHA1

    37e8a566b852ae37b785d7472fd207db926b07ea

  • SHA256

    ddd835d3fc050621ef6dd4468ab68d8898f72f68dbb86c07526a54170592bab8

  • SHA512

    2924656ef964a622b3815d1f4ecbf4548c2f17827e839999e6d5bd9d7037401ee67dd1de4089a5d8432136cbef2d3c384528e80b8e7a5f8d26fecba64288b44c

  • SSDEEP

    6144:vcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8Kc5R+:vSvO2x9mONvKRILSFnOkx2LIaxya5E

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Unexpected DNS network traffic destination 4 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddd835d3fc050621ef6dd4468ab68d8898f72f68dbb86c07526a54170592bab8.exe
    "C:\Users\Admin\AppData\Local\Temp\ddd835d3fc050621ef6dd4468ab68d8898f72f68dbb86c07526a54170592bab8.exe"
    1⤵
    • Unexpected DNS network traffic destination
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5916
  • C:\Windows\Syswow64\dcfdd548
    C:\Windows\Syswow64\dcfdd548
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:32

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\dcfdd548

          Filesize

          448KB

          MD5

          6ac1022f3ac5782a982b336322fed10a

          SHA1

          c908388237ede88d0dad7b08a1906000abde5c4b

          SHA256

          99630cc767d88b4fa945c13f73da5d0ea92b5e350ea790fa6a590b3d64b7a8de

          SHA512

          9e172e29d9c8f5907bfe3d0ecdc09938ae01f11365342e57a45969d7d0dab6db4372d6b338ebf7e4fd3a129ff43dd16af1fa2e616e0cbed4a9f89d9139045fc7

        • memory/32-4-0x0000000000ED0000-0x0000000000F33000-memory.dmp

          Filesize

          396KB

        • memory/5916-0-0x0000000000E90000-0x0000000000EF3000-memory.dmp

          Filesize

          396KB