5b6e9f80c787e237f396735f48b3a2ccaeabe6e5c596693a34e7cb7a7bb4d123

Analysis

max time kernel
138s
max time network
147s
platform
windows7_x64
resource
win7-en-20211208
submitted
19/01/2022, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9275c6f500003801eddde52aec4a2e2.exe
Size 361KB
Sample220119-xbbk3acdd5
SHA256 5b6e9f80c787e237f396735f48b3a2ccaeabe6e5c596693a34e7cb7a7bb4d123
MD5 d9275c6f500003801eddde52aec4a2e2
SHA1 5bcd208738d38b77330768855e6848be2fbfeca5
SHA512 ae0ebb16c5c1968a16afc5eb08e15b5df3400edb740c597f38a5c2090675cd1bc93c2d1f18cae30aac11d91ec6dfc277b497df358ccb721006205a2c0a911d10
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1128	6394064146.exe

Loads dropped DLL 1 IoCs

pid	Process
1552	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

autoit_exe 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000000b1f2-59.dat	autoit_exe
behavioral1/files/0x000500000000b1f2-60.dat	autoit_exe
behavioral1/files/0x000500000000b1f2-61.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1552	1672	d9275c6f500003801eddde52aec4a2e2.exe	31
PID 1672 wrote to memory of 1552	1672	d9275c6f500003801eddde52aec4a2e2.exe	31
PID 1672 wrote to memory of 1552	1672	d9275c6f500003801eddde52aec4a2e2.exe	31
PID 1672 wrote to memory of 1552	1672	d9275c6f500003801eddde52aec4a2e2.exe	31
PID 1552 wrote to memory of 1128	1552	cmd.exe	33
PID 1552 wrote to memory of 1128	1552	cmd.exe	33
PID 1552 wrote to memory of 1128	1552	cmd.exe	33
PID 1552 wrote to memory of 1128	1552	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\d9275c6f500003801eddde52aec4a2e2.exe
"C:\Users\Admin\AppData\Local\Temp\d9275c6f500003801eddde52aec4a2e2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\6394064146.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Users\Admin\AppData\Local\Temp\6394064146.exe
    "C:\Users\Admin\AppData\Local\Temp\6394064146.exe"
    3⤵
    - Executes dropped EXE
    PID:1128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-55-0x0000000076641000-0x0000000076643000-memory.dmp

Download

memory/1672-56-0x0000000000020000-0x0000000000040000-memory.dmp

Download

memory/1672-57-0x0000000000250000-0x0000000000288000-memory.dmp

Download

memory/1672-58-0x0000000000400000-0x0000000000461000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads