c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068

General

Target

c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
Size

1.1MB
MD5

0d0f7df2c659d3f14abac52172635edf
SHA1

c4c95b43b5f6d9d692037183c38ac12c562a2fc0
SHA256

c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068
SHA512

cf8a1bf0dfdbbc7dec99fbcc6036b2c95ba2c7cc1a87b9e7d4d4b439760a97a5c79b99d9d2be1c722e8b15f4eff0cc629104b83f8209a60bf09d65e5e5554b4a
SSDEEP

24576:qZ/sXPww7XsHWtu0AaZ8531jIL+AeH4ZM1rePPZEY95y5OzcL7Ps5i:qZ/sYecHQu0rZK8L+AeYZ4Y9McYL7

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\E:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\H:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\M:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\O:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\X:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\G:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\I:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\V:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\A:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\P:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\Q:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\R:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\W:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\Y:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\Z:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\U:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\F:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\J:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\K:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\L:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\N:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\S:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
File opened (read-only)	\??\T:	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 1492	1992	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1992	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1492	1992	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe	28
PID 1992 wrote to memory of 1492	1992	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe	28
PID 1992 wrote to memory of 1492	1992	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe	28
PID 1992 wrote to memory of 1492	1992	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe	28
PID 1992 wrote to memory of 1492	1992	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe	28
PID 1992 wrote to memory of 1492	1992	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe	28
PID 1992 wrote to memory of 1492	1992	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe	28
PID 1992 wrote to memory of 1492	1992	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe	28
PID 1992 wrote to memory of 1492	1992	c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe	28

C:\Users\Admin\AppData\Local\Temp\c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
"C:\Users\Admin\AppData\Local\Temp\c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe
  "C:\Users\Admin\AppData\Local\Temp\c7c36851a36b6e63f78d53a879b4558e600b18fffc30663b797098a5513c1068.exe"
  2⤵
  PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-56-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1492-57-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1492-59-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1492-61-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1492-62-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing