Overview

overview

10

Static

static

1

d10575ca27...0e.exe

windows7_x64

10

d10575ca27...0e.exe

windows10-2004_x64

7

Analysis

  • max time kernel
    161s
  • max time network
    186s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    10-05-2022 20:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe

  • Size

    336KB

  • MD5

    f3e444d65ca0cc208a5e52feb3c62d5f

  • SHA1

    74dbaef27de86dbb30da205243c431c25c38315e

  • SHA256

    d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e

  • SHA512

    c7832350eee29a25f0d2c7eb73bb24a809100dc95fb3bc9cfdb7d51dff9270feb4b8d0700aa0d5d5d7d56a64bacc4182f9c8ff29df8d3e423fd1f710a5fcc13d

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe
    "C:\Users\Admin\AppData\Local\Temp\d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4820
    • C:\Users\Admin\AppData\Local\Temp\d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe
      "C:\Users\Admin\AppData\Local\Temp\d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe"
      2⤵
        PID:808

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsv45AB.tmp\System.dll
      Filesize

      11KB

      MD5

      fccff8cb7a1067e23fd2e2b63971a8e1

      SHA1

      30e2a9e137c1223a78a0f7b0bf96a1c361976d91

      SHA256

      6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

      SHA512

      f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

      Download Submit
    • memory/808-131-0x0000000000000000-mapping.dmp
      Download
    • memory/808-132-0x0000000000401000-0x0000000000420000-memory.dmp
      Filesize

      124KB

      Download
    • memory/808-133-0x0000000000421000-0x0000000000422000-memory.dmp
      Filesize

      4KB

      Download