dbdac076ffd6370782944478bf95d25a6bf0fbf66bd2f2a180af40574e8f33de

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2022, 05:54

Target
RTGS_Note.exe
Size 2.3MB
Sample221103-glwe8aehh2
SHA256 4462a3f62272eb2165d6068b534c4f0677bddb7cd97aac84406af725845711dd
MD5 5cee36976a9c52e070139bd9d1ae49c0
SHA1 73aebca1dd942abcefb89747a995ded655910b66
SHA512 00a62e1e747f84c12a88b6dc748b7ee02024cd8bd8b08889010b3a10668529cc8a0c44ed01eba3a27850067cbeadc8b1ae046fff0ac3bf7a9e7d65bc009e63b5
SSDEEP 49152:ylkWk5cS7a+9XYaQhZehc4mTYJ78V9gyBn4cDfmP/SA8N:eajJaZ942KQV9hp4kfmP/SA8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1208	4800	RTGS_Note.exe	81
PID 4800 wrote to memory of 1208	4800	RTGS_Note.exe	81
PID 4800 wrote to memory of 1208	4800	RTGS_Note.exe	81

C:\Users\Admin\AppData\Local\Temp\RTGS_Note.exe
"C:\Users\Admin\AppData\Local\Temp\RTGS_Note.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1208

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact