84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822

General

Target

84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe
Size

41KB
MD5

5ed9a5837a0f99733bc5db1e9367a14c
SHA1

bef3ee12140d98f50a811ff129c714ab33c19056
SHA256

84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822
SHA512

d8c3f120df697fcac34a36a578cdc330461e5029e0fccf15e816a79997f23a9029880e8096623b87e6e0623f9a48c495b96aab45c313e3c8c91816d0a0791664
SSDEEP

768:QIBar1ZIZYnfI9opm6AIHIjaI7g9mVmUnToNE/W5dRV8:pW1ZIZqI9opm6AIHIjzmUkNzd

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

sxhost.exe

pid process

948 sxhost.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

332 cmd.exe

pid	process
948	sxhost.exe

pid	process
332	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe

pid	process
1228	84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe
1228	84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exesxhost.exe

description	pid	process	target process
PID 1228 wrote to memory of 948	1228	84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe	sxhost.exe
PID 1228 wrote to memory of 948	1228	84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe	sxhost.exe
PID 1228 wrote to memory of 948	1228	84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe	sxhost.exe
PID 1228 wrote to memory of 948	1228	84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe	sxhost.exe
PID 1228 wrote to memory of 332	1228	84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe	cmd.exe
PID 1228 wrote to memory of 332	1228	84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe	cmd.exe
PID 1228 wrote to memory of 332	1228	84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe	cmd.exe
PID 1228 wrote to memory of 332	1228	84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe	cmd.exe
PID 948 wrote to memory of 1212	948	sxhost.exe	cmd.exe
PID 948 wrote to memory of 1212	948	sxhost.exe	cmd.exe
PID 948 wrote to memory of 1212	948	sxhost.exe	cmd.exe
PID 948 wrote to memory of 1212	948	sxhost.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe
"C:\Users\Admin\AppData\Local\Temp\84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\sxhost.exe
"C:\Users\Admin\sxhost.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c del C:\Users\Admin\sxhost.exe >> NUL
3⤵
PID:1212

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\84CA01~1.EXE >> NUL
2⤵
- Deletes itself
PID:332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\sxhost.exe

Filesize
41KB

MD5
5ed9a5837a0f99733bc5db1e9367a14c

SHA1
bef3ee12140d98f50a811ff129c714ab33c19056

SHA256
84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822

SHA512
d8c3f120df697fcac34a36a578cdc330461e5029e0fccf15e816a79997f23a9029880e8096623b87e6e0623f9a48c495b96aab45c313e3c8c91816d0a0791664

Download Submit
C:\Users\Admin\sxhost.exe

Filesize
41KB

MD5
5ed9a5837a0f99733bc5db1e9367a14c

SHA1
bef3ee12140d98f50a811ff129c714ab33c19056

SHA256
84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822

SHA512
d8c3f120df697fcac34a36a578cdc330461e5029e0fccf15e816a79997f23a9029880e8096623b87e6e0623f9a48c495b96aab45c313e3c8c91816d0a0791664

Download Submit
\Users\Admin\sxhost.exe

Filesize
41KB

MD5
5ed9a5837a0f99733bc5db1e9367a14c

SHA1
bef3ee12140d98f50a811ff129c714ab33c19056

SHA256
84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822

SHA512
d8c3f120df697fcac34a36a578cdc330461e5029e0fccf15e816a79997f23a9029880e8096623b87e6e0623f9a48c495b96aab45c313e3c8c91816d0a0791664

Download Submit
\Users\Admin\sxhost.exe

Filesize
41KB

MD5
5ed9a5837a0f99733bc5db1e9367a14c

SHA1
bef3ee12140d98f50a811ff129c714ab33c19056

SHA256
84ca015b1ccb2ce91299509a05c3e20931a85f0cca646d472e486e95a46e9822

SHA512
d8c3f120df697fcac34a36a578cdc330461e5029e0fccf15e816a79997f23a9029880e8096623b87e6e0623f9a48c495b96aab45c313e3c8c91816d0a0791664

Download Submit
memory/332-61-0x0000000000000000-mapping.dmp

Download
memory/948-58-0x0000000000000000-mapping.dmp

Download
memory/948-63-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/948-65-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1212-64-0x0000000000000000-mapping.dmp

Download
memory/1228-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1228-55-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1228-62-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing