Analysis

  • max time kernel
    140s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 07:50

General

  • Target

    b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe

  • Size

    314KB

  • MD5

    adee40fd23f17db7681b0d49f59485fa

  • SHA1

    df324da199ab4f6401468906f4226815f01fc623

  • SHA256

    b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322

  • SHA512

    a5d4cff12228aa6b7752adb4f82a3eac57ca6c5f4dfc6017290b518d03b48455fc6c43f163f5c1470b3be7cb4e79d1b4bb6d1d36bc0dda707a8e507306566222

  • SSDEEP

    6144:9r2bUzkuvcBYC47l2xib6HwzFyytCr88oDG1GI25i1snqq0o:9r/kuveY3dGwUECr88oDG1GIS+bq0o

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe
    "C:\Users\Admin\AppData\Local\Temp\b47e8252defb9426163d448aebf3ef8bffead2f84916a83f2d7256d0b957c322.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4700

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Tsu665C8DBA.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • C:\Users\Admin\AppData\Local\Temp\{A8A82946-4C53-4860-AA8B-0471734B0BB0}\Custom.dll

    Filesize

    91KB

    MD5

    1e003f7cd537f729059dbf13c4b177ed

    SHA1

    8b13d68eeee3e3be94d961e03a57353245df2fdd

    SHA256

    3b4b5014529df5e4884b64e60c2bbb0a21c986a15f84d82dc2d4490a020741f4

    SHA512

    7ca111f01d6e9180bf1c5b8d6875e92182edf40c211888716ee1288d08dd7b68dacaeeaf2acc614d2cf4ca49a1eaa5228b5124572f628a937f895b05f5764fc0

  • C:\Users\Admin\AppData\Local\Temp\{A8A82946-4C53-4860-AA8B-0471734B0BB0}\_Setup.dll

    Filesize

    173KB

    MD5

    f6d936594abe3af2e6a7aa6e58cb26c4

    SHA1

    4592b94ae4ccd795cdc758627239073264ac4ae9

    SHA256

    3cc0918fc22ec780a8523c53dc114c854ef204849b493b95426d3d70e5e673a5

    SHA512

    a85066315502e32002cc56bb0f126f26a4b1048424888f102611c0095d24db67d437f61e1cca0346f7c3e6453fc6c572ff5de2cc0029d501163e7abc7030c84a