Overview

overview

8

Static

static

26bd8eb8f9...c7.exe

windows7-x64

8

26bd8eb8f9...c7.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2022, 03:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    26bd8eb8f9c7284710e6adc8f15c5aa692167b35464a3df7cf13a52fa50e14c7.exe

  • Size

    872KB

  • MD5

    108deb435d73d5c48c44772369afc220

  • SHA1

    19b8fba12ec6a31c48288ffbb4692e2a14f4ccf9

  • SHA256

    26bd8eb8f9c7284710e6adc8f15c5aa692167b35464a3df7cf13a52fa50e14c7

  • SHA512

    448994c2841f4e4669a5dbf22d1675c036a99f262bd98c7a685049700cefd2854ba0f3108770bce821412d6ef498b24d51b6876c8fd2ef650cbfe4029c2023ef

  • SSDEEP

    6144:l8XXRUw9Oz5+iUPO4RJtvRx7HfnSzObtkLo5vOFTaLTGu0yvHcr+:unRy+vvtHfRVxOFuPyAHcq

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26bd8eb8f9c7284710e6adc8f15c5aa692167b35464a3df7cf13a52fa50e14c7.exe
    "C:\Users\Admin\AppData\Local\Temp\26bd8eb8f9c7284710e6adc8f15c5aa692167b35464a3df7cf13a52fa50e14c7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Users\Admin\AppData\Local\Temp\ixiyjejjshs.exe
      "C:\Users\Admin\AppData\Local\Temp\ixiyjejjshs.exe" "c:\users\admin\appdata\local\temp\26bd8eb8f9c7284710e6adc8f15c5aa692167b35464a3df7cf13a52fa50e14c7.exe*"
      2⤵
      • Executes dropped EXE
      PID:1504

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ixiyjejjshs.exe
    Filesize

    308KB

    MD5

    6d08b79af4fd69dca87044205e11f6d8

    SHA1

    289acaeee807f153b18854dfbb66211e10f501e7

    SHA256

    a87b2530d5a91f2daa91f49289636a9e56882f29b57bef9bafaebf2ceec05d24

    SHA512

    e9ccd21fe428c1c4bfae9bd8b03ab67d14a5fb71a3efc39192bd471bbf3a4e96c3d07350da1063cf3cff25097c745f59eaa92c8b71c3d0d4cf88b3824c9b7daf

    Download Submit

  • \Users\Admin\AppData\Local\Temp\ixiyjejjshs.exe
    Filesize

    308KB

    MD5

    6d08b79af4fd69dca87044205e11f6d8

    SHA1

    289acaeee807f153b18854dfbb66211e10f501e7

    SHA256

    a87b2530d5a91f2daa91f49289636a9e56882f29b57bef9bafaebf2ceec05d24

    SHA512

    e9ccd21fe428c1c4bfae9bd8b03ab67d14a5fb71a3efc39192bd471bbf3a4e96c3d07350da1063cf3cff25097c745f59eaa92c8b71c3d0d4cf88b3824c9b7daf

    Download Submit

  • \Users\Admin\AppData\Local\Temp\ixiyjejjshs.exe
    Filesize

    308KB

    MD5

    6d08b79af4fd69dca87044205e11f6d8

    SHA1

    289acaeee807f153b18854dfbb66211e10f501e7

    SHA256

    a87b2530d5a91f2daa91f49289636a9e56882f29b57bef9bafaebf2ceec05d24

    SHA512

    e9ccd21fe428c1c4bfae9bd8b03ab67d14a5fb71a3efc39192bd471bbf3a4e96c3d07350da1063cf3cff25097c745f59eaa92c8b71c3d0d4cf88b3824c9b7daf

    Download Submit

  • memory/1072-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

    Filesize

    8KB

    Download