3c325eaeacc486269d5eb48812181a5cba605869ca3daf82c1206b8a97fa1244

Analysis

max time kernel
283s
max time network
288s
platform
windows7_x64
resource
win7v20210408
submitted
19/06/2021, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deemix-gui Setup.exe
Size 53.2MB
Sample210619-b5ydajeksx
SHA256 3c325eaeacc486269d5eb48812181a5cba605869ca3daf82c1206b8a97fa1244
MD5 6644bd818f5e0d669019759089f693e8
SHA1 b738a194fda3949001fc6acec66a8fff5f982fe0
SHA512 add6689f4f65bffb5013961bd5d0ff6bba7e61152279f21c6f6451d294bee45f4c32bf046ff163a12fc385002a28c930eabf67093842a7b6f50c7728b859b573
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
784	deemix-gui Setup.exe
784	deemix-gui Setup.exe
784	deemix-gui Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
784	deemix-gui Setup.exe

C:\Users\Admin\AppData\Local\Temp\deemix-gui Setup.exe
"C:\Users\Admin\AppData\Local\Temp\deemix-gui Setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-60-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Download