Overview

overview

10

Static

static

45e00fe90c...5b.exe

windows7_x64

10

45e00fe90c...5b.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    115s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    07/07/2022, 10:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    45e00fe90c8aa8578fce2b305840e368d62578c77e352974da6b8f8bc895d75b.exe
  • Size 191KB
  • Sample220707-mlyhgafcd4
  • SHA256 45e00fe90c8aa8578fce2b305840e368d62578c77e352974da6b8f8bc895d75b
  • MD5 SHA1 SHA512
Score
10/10
samsamransomwarespywarestealertrojan

Malware Config

Signatures

  • SamSam

    SamSam ransomware is a custom infection used in targeted attacks.

    trojanransomwaresamsam
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45e00fe90c8aa8578fce2b305840e368d62578c77e352974da6b8f8bc895d75b.exe
    "C:\Users\Admin\AppData\Local\Temp\45e00fe90c8aa8578fce2b305840e368d62578c77e352974da6b8f8bc895d75b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4940
    • C:\Users\Admin\AppData\Local\Temp\selfdel.exe
      "C:\Users\Admin\AppData\Local\Temp\selfdel.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3344
      • C:\Users\Admin\AppData\Local\Temp\del.exe
        "del.exe" -p 16 samsam.exe
        3⤵
        • Executes dropped EXE
        PID:1152

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        del.exe
        • Path C:\Users\Admin\AppData\Local\Temp\del.exe
        • Size 152KB
        • SHA256 97d27e1225b472a63c88ac9cfb813019b72598b9dd2d70fe93f324f7d034fb95
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        del.exe
        • Path C:\Users\Admin\AppData\Local\Temp\del.exe
        • Size 152KB
        • SHA256 97d27e1225b472a63c88ac9cfb813019b72598b9dd2d70fe93f324f7d034fb95
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        selfdel.exe
        • Path C:\Users\Admin\AppData\Local\Temp\selfdel.exe
        • Size 5KB
        • SHA256 32445c921079aa3e26a376d70ef6550bafeb1f6b0b7037ef152553bb5dad116f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        selfdel.exe
        • Path C:\Users\Admin\AppData\Local\Temp\selfdel.exe
        • Size 5KB
        • SHA256 32445c921079aa3e26a376d70ef6550bafeb1f6b0b7037ef152553bb5dad116f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3344-134-0x00007FFFF9C10000-0x00007FFFFA646000-memory.dmp
        Download

        memory/4940-130-0x00007FFFF9C10000-0x00007FFFFA646000-memory.dmp
        Download