9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8.exe
Size

402KB
MD5

55c71cf638ce823764e9b81621c03d50
SHA1

2db0d568f7b70318df32e786d6afefe457c779f3
SHA256

9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8
SHA512

d0eb90ccc95974632a55f8fd8d6383b433c57376ebe856d88e4ffe494e2e445f6308002e3cf5398d76bee80e0e3fcbcfdedf03b37dd8af6cc094bac257f647da
SSDEEP

6144:AB+pgUn+XU1jeUhNfKLYcO+l1XDwerW4jSlOH6lctNodfBAGJo3lhDyJfFQk32m/:Agv+XUDfKE+3DwerWvCada3O2hAQmr

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1720	9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8.exe
1720	9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Undiges\Savourless0\Folkeafstemningers.kur	9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\Dobbeltfejlene\Brugerprogrammers\Resalutes.Emb	9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8.exe
File opened for modification	C:\Windows\resources\0409\Economite\Polyribosomal.Dis	9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8.exe
File opened for modification	C:\Windows\resources\Coheiress\Emblemizing\Trompeterede.ini	9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1144	1720	9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8.exe	26
PID 1720 wrote to memory of 1144	1720	9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8.exe	26
PID 1720 wrote to memory of 1144	1720	9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8.exe	26
PID 1720 wrote to memory of 1144	1720	9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8.exe	26

C:\Users\Admin\AppData\Local\Temp\9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8.exe
"C:\Users\Admin\AppData\Local\Temp\9b10fcb1d36de6f4dcbc0dd7bfc4b893a0822508fdc62e5635aef319e54e53b8.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Uindfriedes126\Uncertifying\Disneyland\Aftnernes\Unmagistrate\Garantibetalingers.Out
  2⤵
  PID:1144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd6847.tmp\System.dll

Filesize
11KB

MD5
fc3772787eb239ef4d0399680dcc4343

SHA1
db2fa99ec967178cd8057a14a428a8439a961a73

SHA256
9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed

SHA512
79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89

Download Submit
\Users\Admin\AppData\Local\Temp\nsd6847.tmp\nsExec.dll

Filesize
6KB

MD5
1b76bca7bef0f515d39f31e3c084f31d

SHA1
92705562f13db5967e66624286f8291477b7b217

SHA256
80b76b73d2d143b5db4e2d2e24438a68647ae96ac37289415c1caef5c2ed63d3

SHA512
eab2b02b4bdd421e9f4c8bc3ed42b2ff66cc1a2a7ce93a7fe0174bc92e55a6fbc51c0ea65070603208ffb54330cf3e772db5cc1a6c410efa52697e5f5bcc292d

Download Submit
memory/1720-54-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1720-58-0x00000000038D0000-0x00000000039D1000-memory.dmp

Filesize
1.0MB

Download
memory/1720-59-0x00000000038D0000-0x00000000039D1000-memory.dmp

Filesize
1.0MB

Download