c42005e0a00c3ecbaff6c1189ca8b6f1298a818878ceaebb623585c399c8ba81

Analysis

Target

Cotizaciónpdf.exe
Size

245KB
MD5

3fe29e21698212a70e03144bb4979632
SHA1

b400de247096542b778aa7ed7584f6829b5bbf4e
SHA256

c42005e0a00c3ecbaff6c1189ca8b6f1298a818878ceaebb623585c399c8ba81
SHA512

a37080b42f317bcaf288acc2ede4fd178bf8227a6f0650b61378e829458fb26808f6fb64250e32bb737f583ddb75264c1fde488e31ceb57d7890005f04ab723d

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

Cotizaciónpdf.exe

pid process

4060 Cotizaciónpdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4060	Cotizaciónpdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Cotizaciónpdf.exe

description	pid	process	target process
PID 4060 wrote to memory of 3536	4060	Cotizaciónpdf.exe	Cotizaciónpdf.exe
PID 4060 wrote to memory of 3536	4060	Cotizaciónpdf.exe	Cotizaciónpdf.exe
PID 4060 wrote to memory of 3536	4060	Cotizaciónpdf.exe	Cotizaciónpdf.exe
PID 4060 wrote to memory of 3536	4060	Cotizaciónpdf.exe	Cotizaciónpdf.exe
PID 4060 wrote to memory of 3536	4060	Cotizaciónpdf.exe	Cotizaciónpdf.exe
PID 4060 wrote to memory of 3536	4060	Cotizaciónpdf.exe	Cotizaciónpdf.exe
PID 4060 wrote to memory of 3536	4060	Cotizaciónpdf.exe	Cotizaciónpdf.exe
PID 4060 wrote to memory of 3536	4060	Cotizaciónpdf.exe	Cotizaciónpdf.exe

C:\Users\Admin\AppData\Local\Temp\Cotizaciónpdf.exe
"C:\Users\Admin\AppData\Local\Temp\Cotizaciónpdf.exe"
2⤵
PID:3536

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Users\Admin\AppData\Local\Temp\nsh7ADB.tmp\tjbqk.dll
MD5
eed28d9a6df23d102eb1e7db08e9b8a8

SHA1
b1ea3474da51812f436c0d65178aaee00c916628

SHA256
2107ef7267ead9add2cbd586f121a505dcc92db08f9e61d6e2ccca056d4deed5

SHA512
8b133190af32cf0b5c0c5e1b93d84c3ae1a9494ebd0419cd911784804e74232fa15ad4f6d787e897af05e90dd2801772c03dea1282ded7921af25eb0fbe353ab

Download Submit
memory/3536-131-0x0000000000000000-mapping.dmp

Download
memory/3536-132-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download