1032acabd85ab79e88e451e1b4345ab80b2275eb2b9012664dedaa952a2dadbb

Analysis

max time kernel
12s
max time network
156s
platform
windows7_x64
resource
win7v20210408
submitted
22/08/2021, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debd38ec08c22d12ceee6edbb58c4618.exe
Size 405KB
Sample210822-e7ymbg9972
SHA256 1032acabd85ab79e88e451e1b4345ab80b2275eb2b9012664dedaa952a2dadbb
MD5 debd38ec08c22d12ceee6edbb58c4618
SHA1 8011c8f95d6c745a8fd6e5021e101bf8808e8eb3
SHA512 dda6a41587371cd2bbc1c0218110d48a441937e3a8e6cba9bbefa2149f7943105d68c8e17d05944fed4b5954936962c5c836d96a7561da8febcdb1598f4f2cd2
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1720	hq1KARtMH8.exe

Deletes itself 1 IoCs

pid	Process
1720	hq1KARtMH8.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	hq1KARtMH8.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Media source.lnk	hq1KARtMH8.exe

Loads dropped DLL 3 IoCs

pid	Process
1208	debd38ec08c22d12ceee6edbb58c4618.exe
1208	debd38ec08c22d12ceee6edbb58c4618.exe
1720	hq1KARtMH8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1720	1208	debd38ec08c22d12ceee6edbb58c4618.exe	27
PID 1208 wrote to memory of 1720	1208	debd38ec08c22d12ceee6edbb58c4618.exe	27
PID 1208 wrote to memory of 1720	1208	debd38ec08c22d12ceee6edbb58c4618.exe	27
PID 1208 wrote to memory of 1720	1208	debd38ec08c22d12ceee6edbb58c4618.exe	27

C:\Users\Admin\AppData\Local\Temp\debd38ec08c22d12ceee6edbb58c4618.exe
"C:\Users\Admin\AppData\Local\Temp\debd38ec08c22d12ceee6edbb58c4618.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1208
- C:\ProgramData\hq1KARtMH8.exe
  "C:\ProgramData\hq1KARtMH8.exe" C:\Users\Admin\AppData\Local\Temp\debd38ec08c22d12ceee6edbb58c4618.exe
  2⤵
  - Executes dropped EXE
  - Deletes itself
  - Drops startup file
  - Loads dropped DLL
  PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-60-0x0000000075C71000-0x0000000075C73000-memory.dmp

Download

memory/1208-66-0x0000000000400000-0x00000000023CF000-memory.dmp

Download

memory/1208-65-0x00000000023D0000-0x0000000002432000-memory.dmp

Download

memory/1720-68-0x0000000000400000-0x00000000023CF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads