253de8145c186c3d3ff60304eab1f23f4fdd50eb38a212c94847578226af433c

Analysis

Target

74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe
Size

939KB
MD5

9a8a41462d8c437a1861304151333084
SHA1

4de7438431f5fd3e2545e5ab77ac02032b01e923
SHA256

74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0
SHA512

1cdf4e800310359e490284d364228631333499a3019e5a84fbd6f3c63780f38899fcdfd77510892fc5d0f000d822b5b33f6e1eb5a25a85c255360422db341458

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

budha.exe

pid process

2424 budha.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2424	budha.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe

description	pid	process	target process
PID 3884 wrote to memory of 2424	3884	74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe	budha.exe
PID 3884 wrote to memory of 2424	3884	74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe	budha.exe
PID 3884 wrote to memory of 2424	3884	74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe	budha.exe

C:\Users\Admin\AppData\Local\Temp\74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe
"C:\Users\Admin\AppData\Local\Temp\74368a064edba03fecd56aeb572127318861fc9b9d14851cd46029cd5a270ee0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3884

C:\Users\Admin\AppData\Local\Temp\budha.exe
"C:\Users\Admin\AppData\Local\Temp\budha.exe"
2⤵
- Executes dropped EXE
PID:2424

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Users\Admin\AppData\Local\Temp\budha.exe
MD5
a48d9761381e1039a77a86b8aab21cb6

SHA1
6b50fb6ccc900e73fa5b6fecd994758231fdc2ba

SHA256
bf29b64d73d72475e440e1516c702720ad56c2455a6fe6ae2bb7cd3e49744c2d

SHA512
1913ee7aa742166a9c3ff917c4fb53f7a8a87776787f70e0347f9d304f1952d9a22755f5389eafbc0b92d449d6ec0431882e8e290e1351ecff394368a6d008b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\budha.exe
MD5
a48d9761381e1039a77a86b8aab21cb6

SHA1
6b50fb6ccc900e73fa5b6fecd994758231fdc2ba

SHA256
bf29b64d73d72475e440e1516c702720ad56c2455a6fe6ae2bb7cd3e49744c2d

SHA512
1913ee7aa742166a9c3ff917c4fb53f7a8a87776787f70e0347f9d304f1952d9a22755f5389eafbc0b92d449d6ec0431882e8e290e1351ecff394368a6d008b5

Download Submit
memory/2424-2-0x0000000000000000-mapping.dmp

Download
memory/2424-8-0x0000000002510000-0x0000000002910000-memory.dmp

Filesize
4.0MB

Download
memory/2424-7-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3884-5-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/3884-6-0x00000000025E0000-0x00000000029E0000-memory.dmp

Filesize
4.0MB

Download