89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6

Analysis

max time kernel
137s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
Size

3.1MB
MD5

3c823917c3881341bc97c21b11b0c129
SHA1

eeb43e39901920d863fb4c41aaaeead327771faa
SHA256

89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6
SHA512

1a83011d4da7456eec7fdae03c67e508cf2b3ecb2eea661d1ee740614872e9138d66bcf1e75be17455418dc4a6cc90a43965bbaf182c3394e8a40bd99492b04e
SSDEEP

98304:hdfYm0zQMaW7z/alVul6jApWYk+yOPrUCu:XKzQrgz/5oOyOk

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 17 IoCs

Processes:

89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe

pid	process
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
2424	89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe
"C:\Users\Admin\AppData\Local\Temp\89d849d2eb8f31469bb197f09109ffb435f24c5446406c4e33a41ac5590a50c6.exe"
1⤵
- Loads dropped DLL
PID:2424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\Base64.dll

Filesize
4KB

MD5
f0e3845fefd227d7f1101850410ec849

SHA1
3067203fafd4237be0c186ddab7029dfcbdfb53e

SHA256
7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

SHA512
584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\Base64.dll

Filesize
4KB

MD5
f0e3845fefd227d7f1101850410ec849

SHA1
3067203fafd4237be0c186ddab7029dfcbdfb53e

SHA256
7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

SHA512
584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\Base64.dll

Filesize
4KB

MD5
f0e3845fefd227d7f1101850410ec849

SHA1
3067203fafd4237be0c186ddab7029dfcbdfb53e

SHA256
7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

SHA512
584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\Base64.dll

Filesize
4KB

MD5
f0e3845fefd227d7f1101850410ec849

SHA1
3067203fafd4237be0c186ddab7029dfcbdfb53e

SHA256
7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

SHA512
584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\Base64.dll

Filesize
4KB

MD5
f0e3845fefd227d7f1101850410ec849

SHA1
3067203fafd4237be0c186ddab7029dfcbdfb53e

SHA256
7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

SHA512
584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\Base64.dll

Filesize
4KB

MD5
f0e3845fefd227d7f1101850410ec849

SHA1
3067203fafd4237be0c186ddab7029dfcbdfb53e

SHA256
7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

SHA512
584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\DialogEx.dll

Filesize
22KB

MD5
ec138e15734e89232ed5a0e5ee5944ec

SHA1
8ec0f8460f2ac604a22de1b2d531766c80000d04

SHA256
71a46c7173d9c25b9e918a75fa12582ac2404d1b76eb54b28009ac5b73acd3fa

SHA512
4084a5903c2c2a0c2246b11ae61f122939d2e5273f4be0cd97dad6ba70501323edf18b9be0b8cfde23a3e752a695daacf87a596334c87c3a7217239916bd8bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\DialogEx.dll

Filesize
22KB

MD5
ec138e15734e89232ed5a0e5ee5944ec

SHA1
8ec0f8460f2ac604a22de1b2d531766c80000d04

SHA256
71a46c7173d9c25b9e918a75fa12582ac2404d1b76eb54b28009ac5b73acd3fa

SHA512
4084a5903c2c2a0c2246b11ae61f122939d2e5273f4be0cd97dad6ba70501323edf18b9be0b8cfde23a3e752a695daacf87a596334c87c3a7217239916bd8bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8488.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/2424-135-0x0000000004831000-0x0000000004834000-memory.dmp

Filesize
12KB

Download
memory/2424-154-0x0000000004831000-0x0000000004836000-memory.dmp

Filesize
20KB

Download