d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e

Analysis

max time kernel
161s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
10/05/2022, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe
Size 336KB
Sample220510-yse59ahee3
SHA256 d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e
MD5 f3e444d65ca0cc208a5e52feb3c62d5f
SHA1 74dbaef27de86dbb30da205243c431c25c38315e
SHA512 c7832350eee29a25f0d2c7eb73bb24a809100dc95fb3bc9cfdb7d51dff9270feb4b8d0700aa0d5d5d7d56a64bacc4182f9c8ff29df8d3e423fd1f710a5fcc13d
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4820	d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4820 set thread context of 808	4820	d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4820	d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 808	4820	d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe	97
PID 4820 wrote to memory of 808	4820	d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe	97
PID 4820 wrote to memory of 808	4820	d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe	97
PID 4820 wrote to memory of 808	4820	d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe	97
PID 4820 wrote to memory of 808	4820	d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe	97
PID 4820 wrote to memory of 808	4820	d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe	97
PID 4820 wrote to memory of 808	4820	d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe	97
PID 4820 wrote to memory of 808	4820	d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe	97

C:\Users\Admin\AppData\Local\Temp\d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe
"C:\Users\Admin\AppData\Local\Temp\d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe
  "C:\Users\Admin\AppData\Local\Temp\d10575ca2708ecce9f773f6c4e64df3be1f32776a651672a062a56fa4376ec0e.exe"
  2⤵
  PID:808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv45AB.tmp\System.dll
Size 11KB
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/808-132-0x0000000000401000-0x0000000000420000-memory.dmp

Download

memory/808-133-0x0000000000421000-0x0000000000422000-memory.dmp