0ea4b5e412d2be79038ea367836d33c48b10b9ed9d26215c8e2c98e751418d9c

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-en-20211208
submitted
07/02/2022, 06:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Snrkelen2.exe
Size 157KB
Sample220207-g9ht2agff3
SHA256 0ea4b5e412d2be79038ea367836d33c48b10b9ed9d26215c8e2c98e751418d9c
MD5 39d228383d302a5e450859b1ca4eb052
SHA1 d5f47b5a8bc6c86919adad35e31cf530b116a3b2
SHA512 94fab88fb69e1ded4e2a21e399d35efc260f5c1f0ae34e62f9e4d0bd82c076434f249b7704b6a8b1ba78e022a577b762d2ea802c3546484d9e82765385b16369
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1492	Snrkelen2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Snrkelen2.exe
"C:\Users\Admin\AppData\Local\Temp\Snrkelen2.exe"
1⤵
- Loads dropped DLL
PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-55-0x00000000769D1000-0x00000000769D3000-memory.dmp

Download

memory/1492-57-0x00000000024C0000-0x000000000310A000-memory.dmp