253de8145c186c3d3ff60304eab1f23f4fdd50eb38a212c94847578226af433c

Analysis

max time kernel
138s
max time network
151s
platform
windows7_x64
resource
win7v20201028
submitted
15-03-2021 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe
Size

939KB
MD5

9a8a41462d8c437a1861304151333084
SHA1

4de7438431f5fd3e2545e5ab77ac02032b01e923
SHA256

74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0
SHA512

1cdf4e800310359e490284d364228631333499a3019e5a84fbd6f3c63780f38899fcdfd77510892fc5d0f000d822b5b33f6e1eb5a25a85c255360422db341458

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

budha.exe

pid process

2044 budha.exe
Loads dropped DLL 1 IoCs

Processes:

74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe

pid process

1784 74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2044	budha.exe

pid	process
1784	74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe

description	pid	process	target process
PID 1784 wrote to memory of 2044	1784	74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe	budha.exe
PID 1784 wrote to memory of 2044	1784	74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe	budha.exe
PID 1784 wrote to memory of 2044	1784	74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe	budha.exe
PID 1784 wrote to memory of 2044	1784	74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe	budha.exe

C:\Users\Admin\AppData\Local\Temp\74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe
"C:\Users\Admin\AppData\Local\Temp\74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1784

C:\Users\Admin\AppData\Local\Temp\budha.exe
"C:\Users\Admin\AppData\Local\Temp\budha.exe"
2⤵
- Executes dropped EXE
PID:2044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe
MD5
a48d9761381e1039a77a86b8aab21cb6

SHA1
6b50fb6ccc900e73fa5b6fecd994758231fdc2ba

SHA256
bf29b64d73d72475e440e1516c702720ad56c2455a6fe6ae2bb7cd3e49744c2d

SHA512
1913ee7aa742166a9c3ff917c4fb53f7a8a87776787f70e0347f9d304f1952d9a22755f5389eafbc0b92d449d6ec0431882e8e290e1351ecff394368a6d008b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\budha.exe
MD5
a48d9761381e1039a77a86b8aab21cb6

SHA1
6b50fb6ccc900e73fa5b6fecd994758231fdc2ba

SHA256
bf29b64d73d72475e440e1516c702720ad56c2455a6fe6ae2bb7cd3e49744c2d

SHA512
1913ee7aa742166a9c3ff917c4fb53f7a8a87776787f70e0347f9d304f1952d9a22755f5389eafbc0b92d449d6ec0431882e8e290e1351ecff394368a6d008b5

Download Submit
\Users\Admin\AppData\Local\Temp\budha.exe
MD5
a48d9761381e1039a77a86b8aab21cb6

SHA1
6b50fb6ccc900e73fa5b6fecd994758231fdc2ba

SHA256
bf29b64d73d72475e440e1516c702720ad56c2455a6fe6ae2bb7cd3e49744c2d

SHA512
1913ee7aa742166a9c3ff917c4fb53f7a8a87776787f70e0347f9d304f1952d9a22755f5389eafbc0b92d449d6ec0431882e8e290e1351ecff394368a6d008b5

Download Submit
memory/368-12-0x000007FEF6050000-0x000007FEF62CA000-memory.dmp

Filesize
2.5MB

Download
memory/1784-2-0x0000000074D91000-0x0000000074D93000-memory.dmp

Filesize
8KB

Download
memory/1784-6-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/1784-7-0x00000000027E0000-0x0000000002BE0000-memory.dmp

Filesize
4.0MB

Download
memory/2044-4-0x0000000000000000-mapping.dmp

Download
memory/2044-10-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2044-11-0x0000000002770000-0x0000000002B70000-memory.dmp

Filesize
4.0MB

Download