Overview

overview

10

Static

static

1c313fe756...8b.exe

windows7_x64

10

1c313fe756...8b.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    132s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    01/04/2022, 14:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1c313fe7562459e017b46c4dd280e88b.exe
  • Size 233KB
  • Sample220401-r2egrahbdm
  • SHA256 283011e02f08ea4c1dfbf76d7322d2034ad3cbe6f0a839267adcfe2a56fcb2a3
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c313fe7562459e017b46c4dd280e88b.exe
    "C:\Users\Admin\AppData\Local\Temp\1c313fe7562459e017b46c4dd280e88b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:892
    • C:\Users\Admin\AppData\Local\Temp\smkyhybqb.exe
      C:\Users\Admin\AppData\Local\Temp\smkyhybqb.exe C:\Users\Admin\AppData\Local\Temp\nehwgn
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Users\Admin\AppData\Local\Temp\smkyhybqb.exe
        C:\Users\Admin\AppData\Local\Temp\smkyhybqb.exe C:\Users\Admin\AppData\Local\Temp\nehwgn
        3⤵
          PID:1356

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          nehwgn
          • Path C:\Users\Admin\AppData\Local\Temp\nehwgn
          • Size 4KB
          • SHA256 21748760571272a5d33caaeded7c8dbfe7dff18380675a755921427468e005f8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          smkyhybqb.exe
          • Path C:\Users\Admin\AppData\Local\Temp\smkyhybqb.exe
          • Size 4KB
          • SHA256 8ada00bad8b3aed77be669cc4b96e3195b648ab985d761953879baf806e7eafc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          smkyhybqb.exe
          • Path C:\Users\Admin\AppData\Local\Temp\smkyhybqb.exe
          • Size 4KB
          • SHA256 8ada00bad8b3aed77be669cc4b96e3195b648ab985d761953879baf806e7eafc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          u9gjxz40tq93r
          • Path C:\Users\Admin\AppData\Local\Temp\u9gjxz40tq93r
          • Size 213KB
          • SHA256 8847cb0d1252b7955483528d28928f95c532dded6897e67a7d1b26e5a9f68a43
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/1172-136-0x0000000000800000-0x0000000000804000-memory.dmp
          Download