8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed

General

Target

8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe
Size

207KB
MD5

0eb62853b63f5276c9eb21fff540c8be
SHA1

8c112916e5b8154e964bdb2c44cd4a69515619d3
SHA256

8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed
SHA512

73ce830ea331ef4b387520d6754375141b179715ed028fa5b78a293f47bb9dd50c681405e6ef4f3294ea8b0798d73332aa884fe86c220a7a30fae882b8db5646

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ouldcbuhe.exe

pid process

3092 ouldcbuhe.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3092	ouldcbuhe.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exeouldcbuhe.exe

description	pid	process	target process
PID 4668 wrote to memory of 3092	4668	8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe	ouldcbuhe.exe
PID 4668 wrote to memory of 3092	4668	8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe	ouldcbuhe.exe
PID 4668 wrote to memory of 3092	4668	8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe	ouldcbuhe.exe
PID 3092 wrote to memory of 5100	3092	ouldcbuhe.exe	ouldcbuhe.exe
PID 3092 wrote to memory of 5100	3092	ouldcbuhe.exe	ouldcbuhe.exe
PID 3092 wrote to memory of 5100	3092	ouldcbuhe.exe	ouldcbuhe.exe

C:\Users\Admin\AppData\Local\Temp\8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe
"C:\Users\Admin\AppData\Local\Temp\8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe
  C:\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe C:\Users\Admin\AppData\Local\Temp\dndwkg
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe
    C:\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe C:\Users\Admin\AppData\Local\Temp\dndwkg
    3⤵
    PID:5100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\99817is36sdxqig52z

Filesize
103KB

MD5
9a06dfe3724edb2526c756e467c07b9d

SHA1
89188b43bb4c858dce4fc4cacff4774e16ea983e

SHA256
95fb4fd49fae5f806423f002a870f2b3f496ec148b11b7909a027e3d04736c58

SHA512
f29754d7d6249fd60094db388a3b3ea90f037f649bdd4fd208e35d1aaec4bb13fbe8d6679512dfb27cf3bd2e608e0364b3dd865cce958daac35388443662e50d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dndwkg

Filesize
5KB

MD5
ff4c161865c5db1b65de9f3883b44b58

SHA1
ce2fca83ef23188b9c7462b94665ea99ac68b4f1

SHA256
269e6e0da1164feaf77f9b330ac448f1dfe701cefca46045fa8c6e50434000cd

SHA512
a2fe3d85e01d3d01fc69ab02070a517c1689bb95b7dee526343a178a2af8a1ead28417f38c3032d86130c88d846a0a9d99505f7e52c710a7bb24157339249094

Download Submit
C:\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe

Filesize
133KB

MD5
2acc7c61c2a06d45637ad99ccfe6aeda

SHA1
777cfb6f3bdbfbca456ce48618a40ff50f2a29ae

SHA256
924b19e82e132170856549168b5d8cf43cd4e51363032e7a7ef92dc1ab8d938c

SHA512
918bab712925a66b16072a9a63621e776034da5ec1edbec69b46ec8b8d712ccc1290976624770a2cec043ce22fb43c231780bfbffcc55aa0033d56bc7b98a976

Download Submit
C:\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe

Filesize
133KB

MD5
2acc7c61c2a06d45637ad99ccfe6aeda

SHA1
777cfb6f3bdbfbca456ce48618a40ff50f2a29ae

SHA256
924b19e82e132170856549168b5d8cf43cd4e51363032e7a7ef92dc1ab8d938c

SHA512
918bab712925a66b16072a9a63621e776034da5ec1edbec69b46ec8b8d712ccc1290976624770a2cec043ce22fb43c231780bfbffcc55aa0033d56bc7b98a976

Download Submit
memory/3092-130-0x0000000000000000-mapping.dmp

Download
memory/5100-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing