aabe7544db1fafb380e21cc2d80c09b06c8d6b153d9badedeb5622add0d1cd97

Analysis

Target

25ac59efdfd4db2857bd58ebb437dfe9c5d55edfbbbadaaaf27b0f631d3325c7.exe
Size

2.3MB
MD5

102a230cc900e7fc9f1a58be6f976cb3
SHA1

8e3facc711322eb7ebaa16e5c2e92696f1fc1ce8
SHA256

25ac59efdfd4db2857bd58ebb437dfe9c5d55edfbbbadaaaf27b0f631d3325c7
SHA512

925003fe0f6ff00824f42b00a26edf9805691037e09a212a6b5bf3a0e44a1072d457a1aa1fe19500a074fe92c46e08d86c985287af838492a6d1d2210928f0cf

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

zeronet-downloader.exe

pid process

1160 zeronet-downloader.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1160	zeronet-downloader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

25ac59efdfd4db2857bd58ebb437dfe9c5d55edfbbbadaaaf27b0f631d3325c7.exe

pid	process
2336	25ac59efdfd4db2857bd58ebb437dfe9c5d55edfbbbadaaaf27b0f631d3325c7.exe
2336	25ac59efdfd4db2857bd58ebb437dfe9c5d55edfbbbadaaaf27b0f631d3325c7.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

25ac59efdfd4db2857bd58ebb437dfe9c5d55edfbbbadaaaf27b0f631d3325c7.exe

description	pid	process	target process
PID 2336 wrote to memory of 1160	2336	25ac59efdfd4db2857bd58ebb437dfe9c5d55edfbbbadaaaf27b0f631d3325c7.exe	zeronet-downloader.exe
PID 2336 wrote to memory of 1160	2336	25ac59efdfd4db2857bd58ebb437dfe9c5d55edfbbbadaaaf27b0f631d3325c7.exe	zeronet-downloader.exe

C:\Users\Admin\AppData\Local\Temp\F463.tmp\zeronet-downloader.exe
"C:\Users\Admin\AppData\Local\Temp\F463.tmp\zeronet-downloader.exe"
2⤵
- Executes dropped EXE
PID:1160

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Users\Admin\AppData\Local\Temp\F463.tmp\zeronet-downloader.exe
MD5
9e0722e16793b9e6ffd8b48f4033a236

SHA1
b76ebcc61e0d16a93feca87525966d0c4f571ec3

SHA256
b5782642408eb1aa19df1781e8de277e0f586f66632b3171069630651c11e988

SHA512
f12b277330eeac8e04d3d5b69b37c690897fc49c6586e4ec9c5aa412cd64c07fd9c4edfe6607d01fa49ec6efb3d594af6277555ce70cf0d970d1c29ef5f04bd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\F463.tmp\zeronet-downloader.exe
MD5
9e0722e16793b9e6ffd8b48f4033a236

SHA1
b76ebcc61e0d16a93feca87525966d0c4f571ec3

SHA256
b5782642408eb1aa19df1781e8de277e0f586f66632b3171069630651c11e988

SHA512
f12b277330eeac8e04d3d5b69b37c690897fc49c6586e4ec9c5aa412cd64c07fd9c4edfe6607d01fa49ec6efb3d594af6277555ce70cf0d970d1c29ef5f04bd9

Download Submit
memory/1160-118-0x0000000000000000-mapping.dmp

Download