1bd4fe07daaeb321a120cfbd1d02fdfefc2dae30b4dfa50adff0f85939d88792

Analysis

max time kernel
153s
max time network
146s
platform
windows7_x64
resource
win7-en-20210920
submitted
24-09-2021 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3523671dc78bc32e8caf574110eb09023588eb0a9edb91eb7f6afc7c762d332a.exe
Size

425KB
MD5

c50f9125f9bb1a4e5a93e23b577ff25c
SHA1

fa129772bf1201dac210fb1f54dbf949a02e4afd
SHA256

3523671dc78bc32e8caf574110eb09023588eb0a9edb91eb7f6afc7c762d332a
SHA512

2b6419057f66d4231acb25395596e36c3ebb1ba42e7bf7e723867dd9cdb4087bb3316ad2f35c9bcb2f3ac4b29197d516b88b7ead9b5cd062ab6afed9989c2ba1

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

downloader.exe

pid process

1224 downloader.exe

pid	process
1224	downloader.exe

Loads dropped DLL 4 IoCs

Processes:

3523671dc78bc32e8caf574110eb09023588eb0a9edb91eb7f6afc7c762d332a.exe

pid	process
1192	3523671dc78bc32e8caf574110eb09023588eb0a9edb91eb7f6afc7c762d332a.exe
1192	3523671dc78bc32e8caf574110eb09023588eb0a9edb91eb7f6afc7c762d332a.exe
1288
1288

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3523671dc78bc32e8caf574110eb09023588eb0a9edb91eb7f6afc7c762d332a.exe

description	pid	process	target process
PID 1192 wrote to memory of 1224	1192	3523671dc78bc32e8caf574110eb09023588eb0a9edb91eb7f6afc7c762d332a.exe	downloader.exe
PID 1192 wrote to memory of 1224	1192	3523671dc78bc32e8caf574110eb09023588eb0a9edb91eb7f6afc7c762d332a.exe	downloader.exe
PID 1192 wrote to memory of 1224	1192	3523671dc78bc32e8caf574110eb09023588eb0a9edb91eb7f6afc7c762d332a.exe	downloader.exe

C:\Users\Admin\AppData\Local\Temp\3523671dc78bc32e8caf574110eb09023588eb0a9edb91eb7f6afc7c762d332a.exe
"C:\Users\Admin\AppData\Local\Temp\3523671dc78bc32e8caf574110eb09023588eb0a9edb91eb7f6afc7c762d332a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\data\downloader.exe
"C:\Users\Admin\AppData\Local\Temp\data\downloader.exe" preferences-ips
2⤵
- Executes dropped EXE
PID:1224

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\data\downloader.exe
MD5
365e293e4b80813234723fdbe8a68143

SHA1
a066866f4bbc9a37bce66058e3cb19cb95f8c6b7

SHA256
1d7c6fbbb6b9b7a13b2e2c924d22fb76c061f7b6347a69ba6b66632668fa8ed5

SHA512
16108e60f168dc3db7b8169b5d56af47d80013f2d356aee7cc350d67fc8185b9c016c4856caa064d05de45a82fbfc6af77e6e17e514c5fff46a2a2913023411e

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\preferences-ips
MD5
6f3c46b66da466981a0f860a9b396dab

SHA1
5cab0ae7dd9a23e3615934cf25014f8506ec4a02

SHA256
5e901bee4d941183921627ed5b57c018dffe598eb760f9e60b00a367419a00af

SHA512
9011a20c62140820a8fdf53fc7631b993484319c79014a12a50e52a09f9432f14546f33ca5af434039d91e3c90427ca5ab5528ad6c6c51f412527fcfca2815db

Download Submit
\Users\Admin\AppData\Local\Temp\data\downloader.exe
MD5
365e293e4b80813234723fdbe8a68143

SHA1
a066866f4bbc9a37bce66058e3cb19cb95f8c6b7

SHA256
1d7c6fbbb6b9b7a13b2e2c924d22fb76c061f7b6347a69ba6b66632668fa8ed5

SHA512
16108e60f168dc3db7b8169b5d56af47d80013f2d356aee7cc350d67fc8185b9c016c4856caa064d05de45a82fbfc6af77e6e17e514c5fff46a2a2913023411e

Download Submit
\Users\Admin\AppData\Local\Temp\data\downloader.exe
MD5
365e293e4b80813234723fdbe8a68143

SHA1
a066866f4bbc9a37bce66058e3cb19cb95f8c6b7

SHA256
1d7c6fbbb6b9b7a13b2e2c924d22fb76c061f7b6347a69ba6b66632668fa8ed5

SHA512
16108e60f168dc3db7b8169b5d56af47d80013f2d356aee7cc350d67fc8185b9c016c4856caa064d05de45a82fbfc6af77e6e17e514c5fff46a2a2913023411e

Download Submit
\Users\Admin\AppData\Local\Temp\data\downloader.exe
MD5
365e293e4b80813234723fdbe8a68143

SHA1
a066866f4bbc9a37bce66058e3cb19cb95f8c6b7

SHA256
1d7c6fbbb6b9b7a13b2e2c924d22fb76c061f7b6347a69ba6b66632668fa8ed5

SHA512
16108e60f168dc3db7b8169b5d56af47d80013f2d356aee7cc350d67fc8185b9c016c4856caa064d05de45a82fbfc6af77e6e17e514c5fff46a2a2913023411e

Download Submit
\Users\Admin\AppData\Local\Temp\data\downloader.exe
MD5
365e293e4b80813234723fdbe8a68143

SHA1
a066866f4bbc9a37bce66058e3cb19cb95f8c6b7

SHA256
1d7c6fbbb6b9b7a13b2e2c924d22fb76c061f7b6347a69ba6b66632668fa8ed5

SHA512
16108e60f168dc3db7b8169b5d56af47d80013f2d356aee7cc350d67fc8185b9c016c4856caa064d05de45a82fbfc6af77e6e17e514c5fff46a2a2913023411e

Download Submit
memory/1192-54-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download
memory/1224-57-0x0000000000000000-mapping.dmp

Download