2205e931fcca292889c4845eb2b0e961fc7b598c276b6abf71bb5cf6c59c1132

Target

8 (23).exe
Size

3.0MB
MD5

bb072cad921aa5ce8b97706ce01bc570
SHA1

18bf034906c1341b7817e7361ad27a4425d820bd
SHA256

817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
SHA512

d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474

Score

8^/10

Malware Config

Executes dropped EXE 1 IoCs

Processes:

setup_installer.exe

pid process

1804 setup_installer.exe
Loads dropped DLL 1 IoCs

Processes:

8 (23).exe

pid process

772 8 (23).exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1804	setup_installer.exe

pid	process
772	8 (23).exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

8 (23).exe

description	pid	process	target process
PID 772 wrote to memory of 1804	772	8 (23).exe	setup_installer.exe
PID 772 wrote to memory of 1804	772	8 (23).exe	setup_installer.exe
PID 772 wrote to memory of 1804	772	8 (23).exe	setup_installer.exe
PID 772 wrote to memory of 1804	772	8 (23).exe	setup_installer.exe
PID 772 wrote to memory of 1804	772	8 (23).exe	setup_installer.exe
PID 772 wrote to memory of 1804	772	8 (23).exe	setup_installer.exe
PID 772 wrote to memory of 1804	772	8 (23).exe	setup_installer.exe

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
PID:1804

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

MD5
74231678f536a19b3016840f56b845c7

SHA1
a5645777558a7d5905e101e54d61b0c8c1120de3

SHA256
cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4

SHA512
4117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f

Download Submit
\Users\Admin\AppData\Local\Temp\setup_installer.exe

MD5
74231678f536a19b3016840f56b845c7

SHA1
a5645777558a7d5905e101e54d61b0c8c1120de3

SHA256
cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4

SHA512
4117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f

Download Submit
memory/772-59-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/1804-61-0x0000000000000000-mapping.dmp

Download