ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7

General

Target

ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe
Size

3.1MB
MD5

0726ec7142c07db7a861ac82b58d13ed
SHA1

a64c70af9b92ba8a23e6d2e76fbfaf3db18d7f9e
SHA256

ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7
SHA512

f30b739209f5e64069f9d071ded6f27485008d43cd19cb021792fa45f52d5b59cf2828e19e581015e16a8fd3a093af6b29bdda419603168c9bf8757f2b552e5b
SSDEEP

98304:TMSvWG1lNhrpGKsrRORkwk8AjPx/UA3G//E/LSyU:ZekhriLp8AT5NCs/L4

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
1760	ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe
1760	ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe
1760	ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe
1760	ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe
1144	RunDll32.exe
1144	RunDll32.exe
1760	ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1144	1760	ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe	27
PID 1760 wrote to memory of 1144	1760	ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe	27
PID 1760 wrote to memory of 1144	1760	ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe	27
PID 1760 wrote to memory of 1144	1760	ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe	27
PID 1760 wrote to memory of 1144	1760	ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe	27
PID 1760 wrote to memory of 1144	1760	ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe	27
PID 1760 wrote to memory of 1144	1760	ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe	27

C:\Users\Admin\AppData\Local\Temp\ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe
"C:\Users\Admin\AppData\Local\Temp\ab7c0db542078184fb7bdd1e6a9c741979f2b64ab9cbc32e3771e112482b6ec7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\RunDll32.exe
  RunDll32.exe "C:\Users\Admin\AppData\Local\Temp\nst1835.tmp\OCSetupHlp.dll",_RHPID305RHEng2@16 1760,391572885B214C7CAB283CCD8BA72625,616EB24348774180BBD46A202E4E3ADB,3EB8D912EAD9476D8574146D72FF6ED5
  2⤵
  - Loads dropped DLL
  PID:1144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst1835.tmp\OCSetupHlp.dll

Filesize
825KB

MD5
7e7c9da73f17f52486d9d4282fdae1b7

SHA1
d8054c02107b185199e478b28d3be1c57568bde4

SHA256
36d9eccae857dccb3cd8eee7cd876bb047c4c28e8591ce70aca389df6cfe91e4

SHA512
e1f4a8db6c84ce313f54d8e12cb7d28f8cc4c13e3b5e98d45ea1de4b88920ad1b9ab19f9bca7ab4450b6e873275248487c219018aacd2bd71e603826ee03f1e1

Download Submit
\Users\Admin\AppData\Local\Temp\nst1835.tmp\InstallOptions.dll

Filesize
15KB

MD5
89351a0a6a89519c86c5531e20dab9ea

SHA1
9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00

SHA256
f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277

SHA512
13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08

Download Submit
\Users\Admin\AppData\Local\Temp\nst1835.tmp\LangDLL.dll

Filesize
5KB

MD5
a1cd3f159ef78d9ace162f067b544fd9

SHA1
72671fdf4bfeeb99b392685bf01081b4a0b3ae66

SHA256
47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6

SHA512
ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362

Download Submit
\Users\Admin\AppData\Local\Temp\nst1835.tmp\OCSetupHlp.dll

Filesize
825KB

MD5
7e7c9da73f17f52486d9d4282fdae1b7

SHA1
d8054c02107b185199e478b28d3be1c57568bde4

SHA256
36d9eccae857dccb3cd8eee7cd876bb047c4c28e8591ce70aca389df6cfe91e4

SHA512
e1f4a8db6c84ce313f54d8e12cb7d28f8cc4c13e3b5e98d45ea1de4b88920ad1b9ab19f9bca7ab4450b6e873275248487c219018aacd2bd71e603826ee03f1e1

Download Submit
\Users\Admin\AppData\Local\Temp\nst1835.tmp\OCSetupHlp.dll

Filesize
825KB

MD5
7e7c9da73f17f52486d9d4282fdae1b7

SHA1
d8054c02107b185199e478b28d3be1c57568bde4

SHA256
36d9eccae857dccb3cd8eee7cd876bb047c4c28e8591ce70aca389df6cfe91e4

SHA512
e1f4a8db6c84ce313f54d8e12cb7d28f8cc4c13e3b5e98d45ea1de4b88920ad1b9ab19f9bca7ab4450b6e873275248487c219018aacd2bd71e603826ee03f1e1

Download Submit
\Users\Admin\AppData\Local\Temp\nst1835.tmp\OCSetupHlp.dll

Filesize
825KB

MD5
7e7c9da73f17f52486d9d4282fdae1b7

SHA1
d8054c02107b185199e478b28d3be1c57568bde4

SHA256
36d9eccae857dccb3cd8eee7cd876bb047c4c28e8591ce70aca389df6cfe91e4

SHA512
e1f4a8db6c84ce313f54d8e12cb7d28f8cc4c13e3b5e98d45ea1de4b88920ad1b9ab19f9bca7ab4450b6e873275248487c219018aacd2bd71e603826ee03f1e1

Download Submit
\Users\Admin\AppData\Local\Temp\nst1835.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nst1835.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
memory/1760-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing