d314c62264c1d19aa049fd98a3be98dcd0c5974515bf1cadd4c3a85edc369a0b

Analysis

max time kernel
2s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
19/01/2022, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d6d7caccac7437810e1bb63d5bded08.exe
Size 299KB
Sample220119-ld769sgfc9
SHA256 d314c62264c1d19aa049fd98a3be98dcd0c5974515bf1cadd4c3a85edc369a0b
MD5 5d6d7caccac7437810e1bb63d5bded08
SHA1 117aff103f352734457ecaa5e3d0dbbef9b28a3d
SHA512 122875d5fbdef5b327febc884fa603cc3b642c773cd8806624e73ecba2c7876a524154014b735fd73cc880857484039c08b39aac88447f10dbc8501bfcd08bb6
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3128	5d6d7caccac7437810e1bb63d5bded08.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3128 set thread context of 1508	3128	5d6d7caccac7437810e1bb63d5bded08.exe	52

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 1508	3128	5d6d7caccac7437810e1bb63d5bded08.exe	52
PID 3128 wrote to memory of 1508	3128	5d6d7caccac7437810e1bb63d5bded08.exe	52
PID 3128 wrote to memory of 1508	3128	5d6d7caccac7437810e1bb63d5bded08.exe	52
PID 3128 wrote to memory of 1508	3128	5d6d7caccac7437810e1bb63d5bded08.exe	52
PID 3128 wrote to memory of 1508	3128	5d6d7caccac7437810e1bb63d5bded08.exe	52
PID 3128 wrote to memory of 1508	3128	5d6d7caccac7437810e1bb63d5bded08.exe	52
PID 3128 wrote to memory of 1508	3128	5d6d7caccac7437810e1bb63d5bded08.exe	52
PID 3128 wrote to memory of 1508	3128	5d6d7caccac7437810e1bb63d5bded08.exe	52
PID 3128 wrote to memory of 1508	3128	5d6d7caccac7437810e1bb63d5bded08.exe	52

C:\Users\Admin\AppData\Local\Temp\5d6d7caccac7437810e1bb63d5bded08.exe
"C:\Users\Admin\AppData\Local\Temp\5d6d7caccac7437810e1bb63d5bded08.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\AppData\Local\Temp\5d6d7caccac7437810e1bb63d5bded08.exe
  "C:\Users\Admin\AppData\Local\Temp\5d6d7caccac7437810e1bb63d5bded08.exe"
  2⤵
  PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-134-0x0000000000400000-0x00000000004A2000-memory.dmp

Download