c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240

General

Target

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
Size

5.0MB
MD5

dbe9736b562b2bcce0b531fdfeaded32
SHA1

a36ac4af321f97964885b801601aaee816f405d1
SHA256

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240
SHA512

9dc69b482a510482b6aa6992924daf39b96bb43ab9017d6919120288e3d7936717b21aa24cd12c51d64d446eecc626bdc0ddfd0222cff5fde8010d110edea849

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
888	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
360	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
1032	evreporter.exe

Loads dropped DLL 5 IoCs

pid	Process
776	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
1636	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
360	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
360	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
1032	evreporter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
360	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
360	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
360	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 888	776	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	28
PID 776 wrote to memory of 888	776	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	28
PID 776 wrote to memory of 888	776	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	28
PID 776 wrote to memory of 888	776	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	28
PID 776 wrote to memory of 888	776	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	28
PID 776 wrote to memory of 888	776	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	28
PID 776 wrote to memory of 888	776	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	28
PID 888 wrote to memory of 1636	888	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	29
PID 888 wrote to memory of 1636	888	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	29
PID 888 wrote to memory of 1636	888	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	29
PID 888 wrote to memory of 1636	888	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	29
PID 888 wrote to memory of 1636	888	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	29
PID 888 wrote to memory of 1636	888	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	29
PID 888 wrote to memory of 1636	888	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	29
PID 1636 wrote to memory of 360	1636	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	30
PID 1636 wrote to memory of 360	1636	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	30
PID 1636 wrote to memory of 360	1636	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	30
PID 1636 wrote to memory of 360	1636	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	30
PID 1636 wrote to memory of 360	1636	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	30
PID 1636 wrote to memory of 360	1636	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	30
PID 1636 wrote to memory of 360	1636	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	30
PID 360 wrote to memory of 1032	360	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	31
PID 360 wrote to memory of 1032	360	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	31
PID 360 wrote to memory of 1032	360	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	31
PID 360 wrote to memory of 1032	360	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	31

C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
"C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:776
- C:\Users\Admin\AppData\Local\Temp\is-O0RT3.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-O0RT3.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp" /SL5="$B0152,4382530,831488,C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
    "C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe" /VERYSILENT
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\is-8K2NO.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8K2NO.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp" /SL5="$5012C,4382530,831488,C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:360
    - - C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe
        
        "C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-73-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/360-74-0x0000000074601000-0x0000000074603000-memory.dmp

Filesize
8KB

Download
memory/776-55-0x00000000763C1000-0x00000000763C3000-memory.dmp

Filesize
8KB

Download
memory/776-58-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/888-63-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1636-72-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download

Resubmissions

Analysis

Sharing