f9c045d62276239c9dfc9156ecb0b5dfd2b0d3b8e49d9dc8e16fce8fb336264e

Analysis

max time kernel
150s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9c045d62276239c9dfc9156ecb0b5dfd2b0d3b8e49d9dc8e16fce8fb336264e.exe
Size

932KB
MD5

0a194871b7e80da87650b38d5c25def0
SHA1

8e444765579257aac8130f969abba88e89305503
SHA256

f9c045d62276239c9dfc9156ecb0b5dfd2b0d3b8e49d9dc8e16fce8fb336264e
SHA512

3b036ab2b585968d6d5e2bbcfbdab4c5bb940f577a686275e5b1b39bcd9270a8c2db2d2692d82ae1df59ab2354ed75eaffc6337ee0aa57dbdb70935e300a58da
SSDEEP

12288:71/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0FoWxJpcEi0/3IWV//7cSdEYrupcBeahu:71/aGLDCM4D8ayGMZo8/CplRH

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1996	lourgm.exe

Loads dropped DLL 2 IoCs

pid	Process
1608	f9c045d62276239c9dfc9156ecb0b5dfd2b0d3b8e49d9dc8e16fce8fb336264e.exe
1608	f9c045d62276239c9dfc9156ecb0b5dfd2b0d3b8e49d9dc8e16fce8fb336264e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\lourgm.exe"	lourgm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1996	1608	f9c045d62276239c9dfc9156ecb0b5dfd2b0d3b8e49d9dc8e16fce8fb336264e.exe	26
PID 1608 wrote to memory of 1996	1608	f9c045d62276239c9dfc9156ecb0b5dfd2b0d3b8e49d9dc8e16fce8fb336264e.exe	26
PID 1608 wrote to memory of 1996	1608	f9c045d62276239c9dfc9156ecb0b5dfd2b0d3b8e49d9dc8e16fce8fb336264e.exe	26
PID 1608 wrote to memory of 1996	1608	f9c045d62276239c9dfc9156ecb0b5dfd2b0d3b8e49d9dc8e16fce8fb336264e.exe	26

C:\Users\Admin\AppData\Local\Temp\f9c045d62276239c9dfc9156ecb0b5dfd2b0d3b8e49d9dc8e16fce8fb336264e.exe
"C:\Users\Admin\AppData\Local\Temp\f9c045d62276239c9dfc9156ecb0b5dfd2b0d3b8e49d9dc8e16fce8fb336264e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1608
- C:\ProgramData\lourgm.exe
  "C:\ProgramData\lourgm.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Saaaalamm\Mira.h

Filesize
477KB

MD5
71e38cb8371fa644436922e0eee6040d

SHA1
6e9e897cb95fd8434891e87a584f5f1b9482cae2

SHA256
2c97f31658ca63791439d384a5c4488bdca89adac6c363c2cc97e5763af30db4

SHA512
852954de6ce9732c6533d475ebd22f308c5659690d5197dd5865cde0ef740b40f380035baf8d9e6e38dc0541b5f16ffb01ea1560cbb89528ec4b2214c7fcc3be

Download Submit
C:\ProgramData\lourgm.exe

Filesize
454KB

MD5
5232b33a22be33f042aa9d992dfc44da

SHA1
5852d864fe4b13c9c7ce1e33ea4fa148c989f191

SHA256
af6f727800745f444a6f2bb3d81d30ea710963895a4067025efaf15d9aef8d11

SHA512
266bec2e6e12201175aa7cd3c4c3c1f5423f6e0a13d87c8ad6483ab476fb5516a5a6b1321a992816302cd6389b1ee6d33a7d4b475a93078c67766328a14b01d8

Download Submit
C:\ProgramData\lourgm.exe

Filesize
454KB

MD5
5232b33a22be33f042aa9d992dfc44da

SHA1
5852d864fe4b13c9c7ce1e33ea4fa148c989f191

SHA256
af6f727800745f444a6f2bb3d81d30ea710963895a4067025efaf15d9aef8d11

SHA512
266bec2e6e12201175aa7cd3c4c3c1f5423f6e0a13d87c8ad6483ab476fb5516a5a6b1321a992816302cd6389b1ee6d33a7d4b475a93078c67766328a14b01d8

Download Submit
\ProgramData\lourgm.exe

Filesize
454KB

MD5
5232b33a22be33f042aa9d992dfc44da

SHA1
5852d864fe4b13c9c7ce1e33ea4fa148c989f191

SHA256
af6f727800745f444a6f2bb3d81d30ea710963895a4067025efaf15d9aef8d11

SHA512
266bec2e6e12201175aa7cd3c4c3c1f5423f6e0a13d87c8ad6483ab476fb5516a5a6b1321a992816302cd6389b1ee6d33a7d4b475a93078c67766328a14b01d8

Download Submit
\ProgramData\lourgm.exe

Filesize
454KB

MD5
5232b33a22be33f042aa9d992dfc44da

SHA1
5852d864fe4b13c9c7ce1e33ea4fa148c989f191

SHA256
af6f727800745f444a6f2bb3d81d30ea710963895a4067025efaf15d9aef8d11

SHA512
266bec2e6e12201175aa7cd3c4c3c1f5423f6e0a13d87c8ad6483ab476fb5516a5a6b1321a992816302cd6389b1ee6d33a7d4b475a93078c67766328a14b01d8

Download Submit
memory/1608-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1608-60-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download