5006f7e335419bd53914bc920c975c869f3e34dff6578d89fb5efa2ec5780ea5

Analysis

Target

$10,500...payment.exe
Size

362KB
MD5

b4503d42c881483231526eb323664d09
SHA1

9a8b487d92dd811108c6389d0a44b4a732950ccc
SHA256

bcdd4effb61279070652ca7ef77f7ffd5dfb9d8f59dfcea10795ea265e3eb22f
SHA512

5d31d88a3165cb5d4613d3c2477b804c1c6473c203fa8ba2473aa4948f2d263316b7cdf493b36edc58719e24dd4cefd2e9aca4cc42f2cb2616b9bebb819a48fe

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

$10,500...payment.exe

pid process

1544 $10,500...payment.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1544	$10,500...payment.exe

C:\Users\Admin\AppData\Local\Temp\$10,500...payment.exe
"C:\Users\Admin\AppData\Local\Temp\$10,500...payment.exe"
1⤵
- Loads dropped DLL
PID:1544

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nso1843.tmp\glpmgxfxo.dll
MD5
7649db26e2a2e4743a4aeb726eae1550

SHA1
88d0213b224b39802699a39cba1044978cfc14a8

SHA256
26c60ad098e1d2876db0ba32069930748b65cc89304cce4b0da5a07e1400c6ce

SHA512
64129f6198c4fa8ae28ddf247a0e3b3e17d3165bff1929f324e4b98ea2831edf46306a3a971275c753bd75bc0a577825bad82a486bbec942a5c57bfdfbca80d5

Download Submit
memory/1544-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download