e601a9b4dc605b4e283a5b97ed2cb16da2e754b7a6c27585c6f0d1cdbed99094

Analysis

max time kernel
66s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/11/2022, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.5MB
Sample221112-v6kfcaca2x
SHA256 e601a9b4dc605b4e283a5b97ed2cb16da2e754b7a6c27585c6f0d1cdbed99094
MD5 fd31f10421c89f733fdbeace88e3581e
SHA1 d52ff0233ce498c16e3f043ed7bf01259ffba82b
SHA512 5454daf2c114d723b572cafc09cc1ec2d9f2c822714527f3a0d7ef1ba3ff266cc5067f996d9fdb1c24c61e6fb5e577c3f3e55ceb1a6290e6a9f6e015d79d8224
SSDEEP 24576:QTbBv5rUwXVr7zGVBNE6THIsbkowLYTxR5kacOSYUKaMAJ2M7WKRKQAngV:CBDrcfE6TtbkwT5Oh9Mc2M7WKRKHI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
1420	rundll32.exe
1420	rundll32.exe
1420	rundll32.exe
1804	rundll32.exe
1804	rundll32.exe
1804	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1944	1348	file.exe	26
PID 1348 wrote to memory of 1944	1348	file.exe	26
PID 1348 wrote to memory of 1944	1348	file.exe	26
PID 1348 wrote to memory of 1944	1348	file.exe	26
PID 1944 wrote to memory of 1420	1944	control.exe	27
PID 1944 wrote to memory of 1420	1944	control.exe	27
PID 1944 wrote to memory of 1420	1944	control.exe	27
PID 1944 wrote to memory of 1420	1944	control.exe	27
PID 1944 wrote to memory of 1420	1944	control.exe	27
PID 1944 wrote to memory of 1420	1944	control.exe	27
PID 1944 wrote to memory of 1420	1944	control.exe	27
PID 1420 wrote to memory of 1632	1420	rundll32.exe	28
PID 1420 wrote to memory of 1632	1420	rundll32.exe	28
PID 1420 wrote to memory of 1632	1420	rundll32.exe	28
PID 1420 wrote to memory of 1632	1420	rundll32.exe	28
PID 1632 wrote to memory of 1804	1632	RunDll32.exe	29
PID 1632 wrote to memory of 1804	1632	RunDll32.exe	29
PID 1632 wrote to memory of 1804	1632	RunDll32.exe	29
PID 1632 wrote to memory of 1804	1632	RunDll32.exe	29
PID 1632 wrote to memory of 1804	1632	RunDll32.exe	29
PID 1632 wrote to memory of 1804	1632	RunDll32.exe	29
PID 1632 wrote to memory of 1804	1632	RunDll32.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\X5POy.cpL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\X5POy.cpL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\X5POy.cpL",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1632
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\X5POy.cpL",
        5⤵
        Loads dropped DLL
        
        PID:1804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

X5POy.cpL

Path C:\Users\Admin\AppData\Local\Temp\X5POy.cpL
Size 2.2MB
SHA256 8d16c86cf29eb31ef352ffd90e54af9f9b5341c7dccb2d296caa43588a8f822e
MD5 7ee3ddaa584fb02f1949517c51499af2
SHA1 3bff563cfd465090a551322358db4af8ff7ad963
SHA512 1e55098f104496bda354f0db90089b48e996b7f27265ff4f05d05b06cdd7dfb88e995ed21ae3b7b40dfb60dccb2aaacd57177e905acc235d740df28da18f6cc9
SSDEEP 24576:/NpG7uvu9ULBIUtEm8E2M9CQYdPGDDwYDoN9J9Gl2uCxPVOS5:/NJ1LBIUtEm8KCQYFGDDwOEi2lQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

X5Poy.cpl

Path \Users\Admin\AppData\Local\Temp\X5Poy.cpl
Size 2.2MB
SHA256 8d16c86cf29eb31ef352ffd90e54af9f9b5341c7dccb2d296caa43588a8f822e
MD5 7ee3ddaa584fb02f1949517c51499af2
SHA1 3bff563cfd465090a551322358db4af8ff7ad963
SHA512 1e55098f104496bda354f0db90089b48e996b7f27265ff4f05d05b06cdd7dfb88e995ed21ae3b7b40dfb60dccb2aaacd57177e905acc235d740df28da18f6cc9
SSDEEP 24576:/NpG7uvu9ULBIUtEm8E2M9CQYdPGDDwYDoN9J9Gl2uCxPVOS5:/NJ1LBIUtEm8KCQYFGDDwOEi2lQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

X5Poy.cpl

Path \Users\Admin\AppData\Local\Temp\X5Poy.cpl
Size 2.2MB
SHA256 8d16c86cf29eb31ef352ffd90e54af9f9b5341c7dccb2d296caa43588a8f822e
MD5 7ee3ddaa584fb02f1949517c51499af2
SHA1 3bff563cfd465090a551322358db4af8ff7ad963
SHA512 1e55098f104496bda354f0db90089b48e996b7f27265ff4f05d05b06cdd7dfb88e995ed21ae3b7b40dfb60dccb2aaacd57177e905acc235d740df28da18f6cc9
SSDEEP 24576:/NpG7uvu9ULBIUtEm8E2M9CQYdPGDDwYDoN9J9Gl2uCxPVOS5:/NJ1LBIUtEm8KCQYFGDDwOEi2lQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

X5Poy.cpl

Path \Users\Admin\AppData\Local\Temp\X5Poy.cpl
Size 2.2MB
SHA256 8d16c86cf29eb31ef352ffd90e54af9f9b5341c7dccb2d296caa43588a8f822e
MD5 7ee3ddaa584fb02f1949517c51499af2
SHA1 3bff563cfd465090a551322358db4af8ff7ad963
SHA512 1e55098f104496bda354f0db90089b48e996b7f27265ff4f05d05b06cdd7dfb88e995ed21ae3b7b40dfb60dccb2aaacd57177e905acc235d740df28da18f6cc9
SSDEEP 24576:/NpG7uvu9ULBIUtEm8E2M9CQYdPGDDwYDoN9J9Gl2uCxPVOS5:/NJ1LBIUtEm8KCQYFGDDwOEi2lQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

X5Poy.cpl

Path \Users\Admin\AppData\Local\Temp\X5Poy.cpl
Size 2.2MB
SHA256 8d16c86cf29eb31ef352ffd90e54af9f9b5341c7dccb2d296caa43588a8f822e
MD5 7ee3ddaa584fb02f1949517c51499af2
SHA1 3bff563cfd465090a551322358db4af8ff7ad963
SHA512 1e55098f104496bda354f0db90089b48e996b7f27265ff4f05d05b06cdd7dfb88e995ed21ae3b7b40dfb60dccb2aaacd57177e905acc235d740df28da18f6cc9
SSDEEP 24576:/NpG7uvu9ULBIUtEm8E2M9CQYdPGDDwYDoN9J9Gl2uCxPVOS5:/NJ1LBIUtEm8KCQYFGDDwOEi2lQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

X5Poy.cpl

Path \Users\Admin\AppData\Local\Temp\X5Poy.cpl
Size 2.2MB
SHA256 8d16c86cf29eb31ef352ffd90e54af9f9b5341c7dccb2d296caa43588a8f822e
MD5 7ee3ddaa584fb02f1949517c51499af2
SHA1 3bff563cfd465090a551322358db4af8ff7ad963
SHA512 1e55098f104496bda354f0db90089b48e996b7f27265ff4f05d05b06cdd7dfb88e995ed21ae3b7b40dfb60dccb2aaacd57177e905acc235d740df28da18f6cc9
SSDEEP 24576:/NpG7uvu9ULBIUtEm8E2M9CQYdPGDDwYDoN9J9Gl2uCxPVOS5:/NJ1LBIUtEm8KCQYFGDDwOEi2lQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

X5Poy.cpl

Path \Users\Admin\AppData\Local\Temp\X5Poy.cpl
Size 2.2MB
SHA256 8d16c86cf29eb31ef352ffd90e54af9f9b5341c7dccb2d296caa43588a8f822e
MD5 7ee3ddaa584fb02f1949517c51499af2
SHA1 3bff563cfd465090a551322358db4af8ff7ad963
SHA512 1e55098f104496bda354f0db90089b48e996b7f27265ff4f05d05b06cdd7dfb88e995ed21ae3b7b40dfb60dccb2aaacd57177e905acc235d740df28da18f6cc9
SSDEEP 24576:/NpG7uvu9ULBIUtEm8E2M9CQYdPGDDwYDoN9J9Gl2uCxPVOS5:/NJ1LBIUtEm8KCQYFGDDwOEi2lQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1348-54-0x00000000750A1000-0x00000000750A3000-memory.dmp

Download

memory/1420-69-0x0000000002740000-0x00000000027F5000-memory.dmp

Download

memory/1420-65-0x0000000002140000-0x0000000002D8A000-memory.dmp

Download

memory/1420-66-0x0000000002140000-0x0000000002D8A000-memory.dmp

Download

memory/1420-64-0x0000000002140000-0x0000000002D8A000-memory.dmp

Download

memory/1804-78-0x0000000001DC0000-0x0000000002A0A000-memory.dmp

Download

memory/1804-79-0x0000000002A20000-0x0000000002B0C000-memory.dmp

Download

memory/1804-80-0x0000000001DC0000-0x0000000002A0A000-memory.dmp

Download

memory/1804-83-0x00000000003A0000-0x0000000000455000-memory.dmp

Download

memory/1804-82-0x00000000003A0000-0x0000000000455000-memory.dmp

Download

memory/1804-85-0x0000000002A20000-0x0000000002B0C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads