de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429

Analysis

max time kernel
91s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2022, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
Size

3.5MB
MD5

1790f76b0eb3bec25755d2bcc08d29fc
SHA1

1dd404c818aaa6f31f3fd25ee6e9674bbb039937
SHA256

de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429
SHA512

98ebc4379c12301d00d6ad76175821aa349e8f6955379c526e295453ea1f01f81a0b04ffec528cca88cc0a56e1aa8a4479cc870b0323ecc4b9837da6ff0abb78
SSDEEP

98304:aA1/VkydxBNfIhl9N9rNVUverTnM4p4fyO5bZ:ayxBBIhbDNWverTMw4fyO5bZ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
4436	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
4436	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
4436	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
4436	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
4436	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\CLAllSerial_MD_VC120_v3_0_MVS_v3_1_0.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\Log_MD_VC120_v3_0_MVS_v3_1_0.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\MVGigEVisionSDK.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\MediaProcess.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\MvProducerGEV.cti	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\msvcp120.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\UninstRuntime_x86.exe	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\MathParser_MD_VC120_v3_0_MVS_v3_1_0.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\Microsoft.VC90.CRT.manifest	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\MvCameraControl.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\MvProducerU3V.cti	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\MvSdkExport.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\NodeMapData_MD_VC120_v3_0_MVS_v3_1_0.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\avutil-54.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\msvcm90.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\swscale-3.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\GenApi_MD_VC120_v3_0_MVS_v3_1_0.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\CLProtocol_MD_VC120_v3_0_MVS_v3_1_0.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\GCBase_MD_VC120_v3_0_MVS_v3_1_0.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\msvcr90.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\XmlParser_MD_VC120_v3_0_MVS_v3_1_0.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\GCBase_MD_VC120_v3_0.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\Microsoft.VC90.DebugCRT.manifest	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\MvDSS.ax	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\MvRender.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\log4cpp_MD_VC120_v3_0_MVS_v3_1_0.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\msvcr120.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\CLSerCOM.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\FormatConversion.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\MvCamLVision.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\MvUsb3vTL.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
File created	C:\Program Files (x86)\Common Files\MVS\Runtime\Win32_i86\msvcp90.dll	de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe
"C:\Users\Admin\AppData\Local\Temp\de5ca0e523a702fbbdbcefbfcd445ddc16aebaa95bfda70a15be29cc9caa8429.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:4436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nshF2D2.tmp\LogEx.dll

Filesize
44KB

MD5
0f96d9eb959ad4e8fd205e6d58cf01b8

SHA1
7c45512cbdb24216afd23a9e8cdce0cfeaa7660f

SHA256
57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314

SHA512
9f3afb61d75ac7b7dc84abcbf1b04f759b7055992d46140dc5dcc269aed22268d044ee8030f5ea260bbb912774e5bbb751560c16e54efa99c700b9fc7d48832c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshF2D2.tmp\System.dll

Filesize
11KB

MD5
17ed1c86bd67e78ade4712be48a7d2bd

SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0

SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshF2D2.tmp\System.dll

Filesize
11KB

MD5
17ed1c86bd67e78ade4712be48a7d2bd

SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0

SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshF2D2.tmp\UserInfo.dll

Filesize
4KB

MD5
1b446b36f5b4022d50ffdc0cf567b24a

SHA1
d9a0a99fe5ea3932cbd2774af285ddf35fcdd4f9

SHA256
2862c7bc7f11715cebdea003564a0d70bf42b73451e2b672110e1392ec392922

SHA512
04ab80568f6da5eef2bae47056391a5de4ba6aff15cf4a2d0a9cc807816bf565161731921c65fe5ff748d2b86d1661f6aa4311c65992350bd63a9f092019f1b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshF2D2.tmp\UserInfo.dll

Filesize
4KB

MD5
1b446b36f5b4022d50ffdc0cf567b24a

SHA1
d9a0a99fe5ea3932cbd2774af285ddf35fcdd4f9

SHA256
2862c7bc7f11715cebdea003564a0d70bf42b73451e2b672110e1392ec392922

SHA512
04ab80568f6da5eef2bae47056391a5de4ba6aff15cf4a2d0a9cc807816bf565161731921c65fe5ff748d2b86d1661f6aa4311c65992350bd63a9f092019f1b8

Download Submit
memory/4436-135-0x00000000052B1000-0x00000000052B3000-memory.dmp

Filesize
8KB

Download