Overview

overview

7

Static

static

1

bd4db45033...b0.exe

windows7-x64

7

bd4db45033...b0.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 09:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bd4db45033c2d6aef3609c49a2db8c1c70ebee3cae974ffe2e19a103adfd2cb0.exe

  • Size

    3.1MB

  • MD5

    40f43b6bd3d5ea564b5ef4f69055f86b

  • SHA1

    4b48b862e183e7fdf24062b5b352fa7d82cd335b

  • SHA256

    bd4db45033c2d6aef3609c49a2db8c1c70ebee3cae974ffe2e19a103adfd2cb0

  • SHA512

    2aced85e01020e9935047b0c68549b89143868c5abba7e7d1f01613b886204580b3ef2fdf909c44da37c7d449cec593f658090f54cf102284a54598dfdda9561

  • SSDEEP

    98304:vdsall+u1+C4CJAdPpxB5koQ/d8TWpxFhUTAHV:qal14CJAdrkosaTCfmuV

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd4db45033c2d6aef3609c49a2db8c1c70ebee3cae974ffe2e19a103adfd2cb0.exe
    "C:\Users\Admin\AppData\Local\Temp\bd4db45033c2d6aef3609c49a2db8c1c70ebee3cae974ffe2e19a103adfd2cb0.exe"
    1⤵
    • Loads dropped DLL
    PID:4300

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\Base64.dll
    Filesize

    4KB

    MD5

    f0e3845fefd227d7f1101850410ec849

    SHA1

    3067203fafd4237be0c186ddab7029dfcbdfb53e

    SHA256

    7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

    SHA512

    584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\Base64.dll
    Filesize

    4KB

    MD5

    f0e3845fefd227d7f1101850410ec849

    SHA1

    3067203fafd4237be0c186ddab7029dfcbdfb53e

    SHA256

    7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

    SHA512

    584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\Base64.dll
    Filesize

    4KB

    MD5

    f0e3845fefd227d7f1101850410ec849

    SHA1

    3067203fafd4237be0c186ddab7029dfcbdfb53e

    SHA256

    7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

    SHA512

    584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\Base64.dll
    Filesize

    4KB

    MD5

    f0e3845fefd227d7f1101850410ec849

    SHA1

    3067203fafd4237be0c186ddab7029dfcbdfb53e

    SHA256

    7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

    SHA512

    584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\Base64.dll
    Filesize

    4KB

    MD5

    f0e3845fefd227d7f1101850410ec849

    SHA1

    3067203fafd4237be0c186ddab7029dfcbdfb53e

    SHA256

    7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

    SHA512

    584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\Base64.dll
    Filesize

    4KB

    MD5

    f0e3845fefd227d7f1101850410ec849

    SHA1

    3067203fafd4237be0c186ddab7029dfcbdfb53e

    SHA256

    7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

    SHA512

    584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\DialogEx.dll
    Filesize

    22KB

    MD5

    ec138e15734e89232ed5a0e5ee5944ec

    SHA1

    8ec0f8460f2ac604a22de1b2d531766c80000d04

    SHA256

    71a46c7173d9c25b9e918a75fa12582ac2404d1b76eb54b28009ac5b73acd3fa

    SHA512

    4084a5903c2c2a0c2246b11ae61f122939d2e5273f4be0cd97dad6ba70501323edf18b9be0b8cfde23a3e752a695daacf87a596334c87c3a7217239916bd8bc1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\DialogEx.dll
    Filesize

    22KB

    MD5

    ec138e15734e89232ed5a0e5ee5944ec

    SHA1

    8ec0f8460f2ac604a22de1b2d531766c80000d04

    SHA256

    71a46c7173d9c25b9e918a75fa12582ac2404d1b76eb54b28009ac5b73acd3fa

    SHA512

    4084a5903c2c2a0c2246b11ae61f122939d2e5273f4be0cd97dad6ba70501323edf18b9be0b8cfde23a3e752a695daacf87a596334c87c3a7217239916bd8bc1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsx813D.tmp\System.dll
    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    Download Submit

  • memory/4300-135-0x00000000022D1000-0x00000000022D4000-memory.dmp

    Filesize

    12KB

    Download

  • memory/4300-154-0x00000000022D1000-0x00000000022D6000-memory.dmp

    Filesize

    20KB

    Download