b56c9109fdb9e8d8853fa536f3cdea9528a8a53493d3f3dc9f49243e30ed6be5

Analysis

max time kernel
144s
max time network
145s
platform
windows10_x64
resource
win10v20201028
submitted
06/04/2021, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
82B44946E89CC6EE027BEBC354330843.exe
Size 287KB
Sample210406-8f2jqddg4x
SHA256 b56c9109fdb9e8d8853fa536f3cdea9528a8a53493d3f3dc9f49243e30ed6be5
MD5 82b44946e89cc6ee027bebc354330843
SHA1 cd46ddde5fa93f7546aaa4fd419ff183d79aa1d1
SHA512 4202e9267516fd75c13fa28917d8b9dd1f6770be599ec1219aa4d8a289bb68b2e3af47e176ddb087674e95b0c9c9058339aa9d6f92adb9f034b878c3971cb580
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4392	1.exe

Loads dropped DLL 5 IoCs

pid	Process
4804	82B44946E89CC6EE027BEBC354330843.exe
4804	82B44946E89CC6EE027BEBC354330843.exe
4392	1.exe
4392	1.exe
4392	1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000100000001ab7e-5.dat	nsis_installer_1
behavioral2/files/0x000100000001ab7e-5.dat	nsis_installer_2
behavioral2/files/0x000100000001ab7e-6.dat	nsis_installer_1
behavioral2/files/0x000100000001ab7e-6.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4392	4804	82B44946E89CC6EE027BEBC354330843.exe	75
PID 4804 wrote to memory of 4392	4804	82B44946E89CC6EE027BEBC354330843.exe	75
PID 4804 wrote to memory of 4392	4804	82B44946E89CC6EE027BEBC354330843.exe	75

C:\Users\Admin\AppData\Local\Temp\82B44946E89CC6EE027BEBC354330843.exe
"C:\Users\Admin\AppData\Local\Temp\82B44946E89CC6EE027BEBC354330843.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\nsy6875.tmp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy6875.tmp\1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4392-10-0x0000000002811000-0x0000000002813000-memory.dmp

Download