74bafd56c1fb3cdebf0a63de4ffb6f16dc1d5cee38e11ab0d2bc2614538da65f

Analysis

max time kernel
126s
max time network
131s
platform
windows10_x64
resource
win10-en-20211014
submitted
17/10/2021, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74BAFD56C1FB3CDEBF0A63DE4FFB6F16DC1D5CEE38E11.exe
Size 5.5MB
Sample211017-nc5qvsdddl
SHA256 74bafd56c1fb3cdebf0a63de4ffb6f16dc1d5cee38e11ab0d2bc2614538da65f
MD5 ca08876db58056ad35cadc2afeb89ab7
SHA1 e18efa556280140ff92048fa499d729aa4bce089
SHA512 c801c8019c911e2e298907fb5ac116d635e4a6b7227db7547908653f7cd680c0ebf71dba3660b8bbc87cfe3df4f8c6fbc332f11cb719466d5b311e7a721bfa27
MD5 SHA1 SHA512

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000400000001ab96-122.dat	aspack_v212_v242
behavioral2/files/0x000400000001ab96-123.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
2732	setup.exe
2952	setup_install.exe

Loads dropped DLL 4 IoCs

pid	Process
2952	setup_install.exe
2952	setup_install.exe
2952	setup_install.exe
2952	setup_install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2732	1940	74BAFD56C1FB3CDEBF0A63DE4FFB6F16DC1D5CEE38E11.exe	69
PID 1940 wrote to memory of 2732	1940	74BAFD56C1FB3CDEBF0A63DE4FFB6F16DC1D5CEE38E11.exe	69
PID 1940 wrote to memory of 2732	1940	74BAFD56C1FB3CDEBF0A63DE4FFB6F16DC1D5CEE38E11.exe	69
PID 2732 wrote to memory of 2952	2732	setup.exe	70
PID 2732 wrote to memory of 2952	2732	setup.exe	70
PID 2732 wrote to memory of 2952	2732	setup.exe	70
PID 2952 wrote to memory of 660	2952	setup_install.exe	73
PID 2952 wrote to memory of 660	2952	setup_install.exe	73
PID 2952 wrote to memory of 660	2952	setup_install.exe	73

C:\Users\Admin\AppData\Local\Temp\74BAFD56C1FB3CDEBF0A63DE4FFB6F16DC1D5CEE38E11.exe
"C:\Users\Admin\AppData\Local\Temp\74BAFD56C1FB3CDEBF0A63DE4FFB6F16DC1D5CEE38E11.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\7zSCAA837F5\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCAA837F5\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\d4a28e6e7c345f2fe12.exe
      4⤵
      PID:660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-129-0x0000000061880000-0x00000000618B7000-memory.dmp

Download

memory/2952-130-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2952-131-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2952-134-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2952-132-0x0000000064940000-0x0000000064959000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads