Analysis

  • max time kernel
    130s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 09:02

General

  • Target

    491a85b370321bcbf3367a2dc2c31ae12a59deb0018f1ef6906345f6434f4560.exe

  • Size

    304KB

  • MD5

    d9db5c1c2e61373f60daa4f82b816dad

  • SHA1

    e32961eb11e66bd03ec30e2fabd32d75b4d2e3fb

  • SHA256

    491a85b370321bcbf3367a2dc2c31ae12a59deb0018f1ef6906345f6434f4560

  • SHA512

    ca0493cceca060a16f2544f5aaac2d61e9425f58d23cc21f5ce0f05c8030d3123fbe5028219f32de7f6171615edb391109dac85dec237d4dd43070d56e13baac

  • SSDEEP

    6144:3rkx9uEo2S1YnQmCX492DkwNP3qpYFkXdlP5IO5/OoCVHuy6SHZ86riVZkiizP:3rkHu6/eIo4RXdrIO5/OpVHd6Ky6riza

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\491a85b370321bcbf3367a2dc2c31ae12a59deb0018f1ef6906345f6434f4560.exe
    "C:\Users\Admin\AppData\Local\Temp\491a85b370321bcbf3367a2dc2c31ae12a59deb0018f1ef6906345f6434f4560.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:2012

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Tsu5BE10534.dll
    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • \Users\Admin\AppData\Local\Temp\{ACFE6656-7844-44AD-A646-3066771D44A0}\Custom.dll
    Filesize

    73KB

    MD5

    e8d86c771d7e23b080921b9803f1654c

    SHA1

    49d8ef6835a6de734ead4e0b2cbbc65735cd5c17

    SHA256

    cc7a340bffc39d8d8f704314f0383404590438b8cd16e780e0a26723bceedd21

    SHA512

    b9902e0112bbf053ec4e3aa633ac2f2dd938b23507ff58ed69ac580656e42874c4b0ccb0d393b26637ae2b98feee78023d62378adb99140736e314de74fb399b

  • \Users\Admin\AppData\Local\Temp\{ACFE6656-7844-44AD-A646-3066771D44A0}\_Setup.dll
    Filesize

    167KB

    MD5

    262cc5a5e5a007ae182c45e41ac35adf

    SHA1

    999582209e73d92d0040b8092666087aac2cee90

    SHA256

    ecc186e0284593db51463f104ba8486b1de656d47a290d27c6fea157cb1495bd

    SHA512

    2f59e23646774c3e5034d464242ac128cfb3ced1a0498dd0f719308b5854fbba20d457127e01b414f12b63d8bc3baf7ffcf89d91300ca43b90ed6cc933e4bd5b

  • memory/2012-55-0x0000000075E81000-0x0000000075E83000-memory.dmp
    Filesize

    8KB