Overview

overview

8

Static

static

86267fab2e...1c.exe

windows7-x64

8

86267fab2e...1c.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 14:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe

  • Size

    167KB

  • MD5

    41ad48f02009727cfcc4c8ec129646d4

  • SHA1

    2d3fefacd4b7b6e6a74a30f9b1c28358d0eb31bf

  • SHA256

    86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c

  • SHA512

    09ab980707bed990d139ab673c893daa8469020ca0bf8d59c1d0f2975142c1df7301b10aef5d079506069969b0d33ea09a40bd07a2ce21e8a98e26681e66cf23

  • SSDEEP

    3072:AJSQuQ1QyQcQ+TT/T6EutTBfMkvDoHo6Uf1RD5bdu6y7F9bN2ocp7:oSbC9LjT/eEutTB/D6o6KDbdu6y7FlNY

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe
    "C:\Users\Admin\AppData\Local\Temp\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\7073724\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe
      "C:\Users\Admin\AppData\Local\Temp\7073724\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1128

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7073724\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe
    Filesize

    257KB

    MD5

    9c710dbe8e355259131f87d0cdc0f205

    SHA1

    abefb4e91eb6cfa3e9c79ee6ef4c939d5e1ec87d

    SHA256

    1c710b9527ff12f0b01293d4e3fc21c1cc4123bef7f3058fed84a409e1f3c498

    SHA512

    fe44a1952763b94d6dceb104ba69ad3ec0e00b271d7b8fdaa3d10cb8121c18bf01b60de64249bf53b962a92f1393c225e06e29eed8d52c7b0a8b9eadefbe6eb0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7073724\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe
    Filesize

    257KB

    MD5

    9c710dbe8e355259131f87d0cdc0f205

    SHA1

    abefb4e91eb6cfa3e9c79ee6ef4c939d5e1ec87d

    SHA256

    1c710b9527ff12f0b01293d4e3fc21c1cc4123bef7f3058fed84a409e1f3c498

    SHA512

    fe44a1952763b94d6dceb104ba69ad3ec0e00b271d7b8fdaa3d10cb8121c18bf01b60de64249bf53b962a92f1393c225e06e29eed8d52c7b0a8b9eadefbe6eb0

    Download Submit

  • \Users\Admin\AppData\Local\Temp\7073724\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe
    Filesize

    257KB

    MD5

    9c710dbe8e355259131f87d0cdc0f205

    SHA1

    abefb4e91eb6cfa3e9c79ee6ef4c939d5e1ec87d

    SHA256

    1c710b9527ff12f0b01293d4e3fc21c1cc4123bef7f3058fed84a409e1f3c498

    SHA512

    fe44a1952763b94d6dceb104ba69ad3ec0e00b271d7b8fdaa3d10cb8121c18bf01b60de64249bf53b962a92f1393c225e06e29eed8d52c7b0a8b9eadefbe6eb0

    Download Submit

  • \Users\Admin\AppData\Local\Temp\7073724\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe
    Filesize

    257KB

    MD5

    9c710dbe8e355259131f87d0cdc0f205

    SHA1

    abefb4e91eb6cfa3e9c79ee6ef4c939d5e1ec87d

    SHA256

    1c710b9527ff12f0b01293d4e3fc21c1cc4123bef7f3058fed84a409e1f3c498

    SHA512

    fe44a1952763b94d6dceb104ba69ad3ec0e00b271d7b8fdaa3d10cb8121c18bf01b60de64249bf53b962a92f1393c225e06e29eed8d52c7b0a8b9eadefbe6eb0

    Download Submit

  • memory/1676-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

    Filesize

    8KB

    Download