95c30ee77cf4d9e39a29a1dff147a9154b0dd7a6499b9deae1537d3ecabf4774

General

Target
obi.exe
Size 423KB
Sample220509-yandxaeaa9
SHA256 95c30ee77cf4d9e39a29a1dff147a9154b0dd7a6499b9deae1537d3ecabf4774
MD5 4fc8947cc4de2a9c5f09c5c78155881b
SHA1 cc92312afbbe2057cf663036993462261e468301
SHA512 73da869237a64d5c024af6d957c184c8c82b95d3f5dd0c56c8383d2eda0c8d87fbd2ccd131c4231b5436873e61c5ac0ee88f4bb5bebfc5e5071c24216723d09e
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4028	gilfpmu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4028	4128	obi.exe	83
PID 4128 wrote to memory of 4028	4128	obi.exe	83
PID 4128 wrote to memory of 4028	4128	obi.exe	83
PID 4028 wrote to memory of 3576	4028	gilfpmu.exe	84
PID 4028 wrote to memory of 3576	4028	gilfpmu.exe	84
PID 4028 wrote to memory of 3576	4028	gilfpmu.exe	84

C:\Users\Admin\AppData\Local\Temp\obi.exe
"C:\Users\Admin\AppData\Local\Temp\obi.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\gilfpmu.exe
  C:\Users\Admin\AppData\Local\Temp\gilfpmu.exe C:\Users\Admin\AppData\Local\Temp\dzbzcqhaih
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Users\Admin\AppData\Local\Temp\gilfpmu.exe
    C:\Users\Admin\AppData\Local\Temp\gilfpmu.exe C:\Users\Admin\AppData\Local\Temp\dzbzcqhaih
    3⤵
    PID:3576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dzbzcqhaih

Path C:\Users\Admin\AppData\Local\Temp\dzbzcqhaih
Size 4KB
SHA256 7094e4814358700d3ffadb9ac8f20d60c602ae220026907cdd8aae7d5576b7d8
MD5 3bd8cd576d2ce8c12aa5f7a6947c1ea5
SHA1 39c8df616199db99ff20293c0552e3afbbced68f
SHA512 9c3e348ad31ba00ad6c8cd75d8f79bfcd52cdc49f1f676cb2ab868a260273b551fc47f840b8da1be656d92d6a8e727f7e72842cd011a6ca2fcb45ed2008c517c
SSDEEP 96:dLjne0Yunq+r27TEAgjN5A0FmFLmn2MB7zgEbEqzy4Q7l:xj939r+TAx5LmFLno/HRzZQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

gilfpmu.exe

Path C:\Users\Admin\AppData\Local\Temp\gilfpmu.exe
Size 78KB
SHA256 372db44e645502e1d82787644e87a03a2f3aea7a26bb96090f53bd341d275657
MD5 176b4deb425092cd908859803b0eac28
SHA1 d543c3ba5b1732aa14cbca76ab73b815fec5a936
SHA512 604bb20b84d7b180a9deb0572f976e681771b0c6af6ac416ce75a4ac58eb712ab5c659bf5524cdc9b64e4108961e5390aa5e31b4f5cd470bc1c66d0664c17817
SSDEEP 1536:sOwsrCCRps1oxuCntY3Ykgr+1ccAxSpsWjcdZE4z0e:seRiIftu7AQWm4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

gilfpmu.exe

Path C:\Users\Admin\AppData\Local\Temp\gilfpmu.exe
Size 78KB
SHA256 372db44e645502e1d82787644e87a03a2f3aea7a26bb96090f53bd341d275657
MD5 176b4deb425092cd908859803b0eac28
SHA1 d543c3ba5b1732aa14cbca76ab73b815fec5a936
SHA512 604bb20b84d7b180a9deb0572f976e681771b0c6af6ac416ce75a4ac58eb712ab5c659bf5524cdc9b64e4108961e5390aa5e31b4f5cd470bc1c66d0664c17817
SSDEEP 1536:sOwsrCCRps1oxuCntY3Ykgr+1ccAxSpsWjcdZE4z0e:seRiIftu7AQWm4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

xzzxza8dlp2hxtq3wl

Path C:\Users\Admin\AppData\Local\Temp\xzzxza8dlp2hxtq3wl
Size 184KB
SHA256 68af1c2407cde648ad504f072276e941e7d7abc4cbbd30af762bb43f221b8f24
MD5 b7742c5d25e32202b5020cda1b33f77a
SHA1 91071c6dd6b53a6da218ea2b45cb1343f691582b
SHA512 29629a2e7b01b834a42b1f90bb49d7f475e4cabacf78815852a2c4b8a883bf7385ea0aa29ae139deefc28ca5cf764d05bfd014041874dbd0b789fd57b8555dac
SSDEEP 3072:d9Ce5C/M9NFBhH0F8Y5djGAnKUzodH1rlzM3KULl6g4pv98xy/oQRWAOfwrW/hE9:fd5CkzFBhU+IGAnZz2A3KgeplT/JhW/S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads