f7d7c3c283891a3fdffccf5dbd1da3a841064cd393aed4eab3987dfb1d93a51c

General

Target

BANK_DET.exe
Size

434KB
MD5

97c8146c10d533dacaaca193761b1c98
SHA1

dff81aa37ff7d60095615682ded6490f188ae959
SHA256

3c7e44e2b240655a3f18fde494d90ba07478b3e28f0161f63ecfd48049a7d554
SHA512

e387b91b904e4d29de77c196cf32541b26e968341be4011b386504f47c737ad066bba23b428464a2f2ca516c5f9fc1f88d14e25c5dfc497f4a3bb9c1f72038d4

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

896 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

944 896 WerFault.exe rundll32.exe

pid	process
896	rundll32.exe

pid	pid_target	process	target process
944	896	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

BANK_DET.exerundll32.exe

description	pid	process	target process
PID 620 wrote to memory of 896	620	BANK_DET.exe	rundll32.exe
PID 620 wrote to memory of 896	620	BANK_DET.exe	rundll32.exe
PID 620 wrote to memory of 896	620	BANK_DET.exe	rundll32.exe
PID 620 wrote to memory of 896	620	BANK_DET.exe	rundll32.exe
PID 620 wrote to memory of 896	620	BANK_DET.exe	rundll32.exe
PID 620 wrote to memory of 896	620	BANK_DET.exe	rundll32.exe
PID 620 wrote to memory of 896	620	BANK_DET.exe	rundll32.exe
PID 896 wrote to memory of 944	896	rundll32.exe	WerFault.exe
PID 896 wrote to memory of 944	896	rundll32.exe	WerFault.exe
PID 896 wrote to memory of 944	896	rundll32.exe	WerFault.exe
PID 896 wrote to memory of 944	896	rundll32.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\BANK_DET.exe
"C:\Users\Admin\AppData\Local\Temp\BANK_DET.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 228
3⤵
- Program crash
PID:944

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Users\Admin\AppData\Local\Temp\Helenium
Filesize
176KB

MD5
958c339f8ed8b251838ff8d5d3ab52aa

SHA1
d840cd535392c97a4a2a51630a34a0a1d85eea1f

SHA256
a2a46b00c8bf3b05d08c6d52e0ecc106637426c7eb7ab4c6d02910a38591f905

SHA512
40856851c12c11c669f8935909e6cbd78133df17ba0e4d8c7ddc9730abd178e875347e52e3a5503e31b7a3449912843e859132272485b9e33a2e8cfe648e8c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pentagon.DLL
Filesize
56KB

MD5
84efccfc8c97ebda74559a289f41c769

SHA1
5325f8b9e8a20a0ac8911f48b6f744c69665650a

SHA256
0515fa8a1ed1d74e440cb372c981b8e3b703fe5c1593e26deaba5a47704cebc8

SHA512
8c0845739ee37d658c91899f947604cbd69c126e9e0cfc6af275a007ef99802cf86e4af4af180b4a14a786aec9645144f737dafb87543c7d3faa13544888e66b

Download Submit
\Users\Admin\AppData\Local\Temp\Pentagon.dll
Filesize
56KB

MD5
84efccfc8c97ebda74559a289f41c769

SHA1
5325f8b9e8a20a0ac8911f48b6f744c69665650a

SHA256
0515fa8a1ed1d74e440cb372c981b8e3b703fe5c1593e26deaba5a47704cebc8

SHA512
8c0845739ee37d658c91899f947604cbd69c126e9e0cfc6af275a007ef99802cf86e4af4af180b4a14a786aec9645144f737dafb87543c7d3faa13544888e66b

Download Submit
memory/620-54-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download
memory/896-55-0x0000000000000000-mapping.dmp

Download
memory/896-61-0x0000000000120000-0x0000000000123000-memory.dmp

Filesize
12KB

Download
memory/944-60-0x0000000000000000-mapping.dmp

Download