c395cac84bc2e0b97881975f47d3a6213c2f0b162ebdc8037d5defbe89a63f1b

Analysis

Target
091c1f4e0b8ad4e44fe9ab6d0a1341a0.exe
Size 306KB
Sample220301-ld7kqsheb8
SHA256 c395cac84bc2e0b97881975f47d3a6213c2f0b162ebdc8037d5defbe89a63f1b
MD5 091c1f4e0b8ad4e44fe9ab6d0a1341a0
SHA1 b4323aac8cdec7886085a121e46db84d6cbdfd23
SHA512 1228c3acfc31870a1d2663dbfb3de4f74f893e68e3b9c556142d67a6afbbd62eb5360db0fa340544d0f5eb3dec0c7ad4d2edf7f7f35948154f5a0c61e2f0a0c1
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2308	vxkrefoai.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 2308	208	091c1f4e0b8ad4e44fe9ab6d0a1341a0.exe	57
PID 208 wrote to memory of 2308	208	091c1f4e0b8ad4e44fe9ab6d0a1341a0.exe	57
PID 208 wrote to memory of 2308	208	091c1f4e0b8ad4e44fe9ab6d0a1341a0.exe	57
PID 2308 wrote to memory of 4044	2308	vxkrefoai.exe	58
PID 2308 wrote to memory of 4044	2308	vxkrefoai.exe	58
PID 2308 wrote to memory of 4044	2308	vxkrefoai.exe	58

C:\Users\Admin\AppData\Local\Temp\091c1f4e0b8ad4e44fe9ab6d0a1341a0.exe
"C:\Users\Admin\AppData\Local\Temp\091c1f4e0b8ad4e44fe9ab6d0a1341a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:208
- C:\Users\Admin\AppData\Local\Temp\vxkrefoai.exe
  C:\Users\Admin\AppData\Local\Temp\vxkrefoai.exe C:\Users\Admin\AppData\Local\Temp\vxwjyvdtbb
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\vxkrefoai.exe
    C:\Users\Admin\AppData\Local\Temp\vxkrefoai.exe C:\Users\Admin\AppData\Local\Temp\vxwjyvdtbb
    3⤵
    PID:4044

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact