7de9f7a81557d4a2a6818b50b8f8ab8948ce6329bf1c696d038e1231237a07d0

Analysis

Target
Boat Payment Copy.exe
Size 301KB
Sample220321-py4alaccc4
SHA256 7de9f7a81557d4a2a6818b50b8f8ab8948ce6329bf1c696d038e1231237a07d0
MD5 5978c05476263bda7d960999d199231b
SHA1 ddb2e6c5412027261ca3f339e73a309451aa88b0
SHA512 7edb0538af7dec08f7f5150b26c525cd2bd4d101a08dec8d48e64619206006ba1daa489ef6c9be2db496832add886da040ef0730320558e4dc5ca0b30a81f65e
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4544	xabehid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4544	2116	Boat Payment Copy.exe	85
PID 2116 wrote to memory of 4544	2116	Boat Payment Copy.exe	85
PID 2116 wrote to memory of 4544	2116	Boat Payment Copy.exe	85
PID 4544 wrote to memory of 4476	4544	xabehid.exe	86
PID 4544 wrote to memory of 4476	4544	xabehid.exe	86
PID 4544 wrote to memory of 4476	4544	xabehid.exe	86

C:\Users\Admin\AppData\Local\Temp\Boat Payment Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Boat Payment Copy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\xabehid.exe
  C:\Users\Admin\AppData\Local\Temp\xabehid.exe C:\Users\Admin\AppData\Local\Temp\rmyft
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Users\Admin\AppData\Local\Temp\xabehid.exe
    C:\Users\Admin\AppData\Local\Temp\xabehid.exe C:\Users\Admin\AppData\Local\Temp\rmyft
    3⤵
    PID:4476

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact