Overview

overview

8

Static

static

1

e10ec89946...88.exe

windows7-x64

8

e10ec89946...88.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 10:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e10ec89946c23cc52bcc34e8a79713fd6e01d3610834d2b1133d9ece85b9f288.exe

  • Size

    1.1MB

  • MD5

    6c0faa0de1d8f6f04bca3cf8919f5e4e

  • SHA1

    f61d380dbfefce4c396145954e308e9819602c99

  • SHA256

    e10ec89946c23cc52bcc34e8a79713fd6e01d3610834d2b1133d9ece85b9f288

  • SHA512

    6bd160a411ee7d98ae4304f580f501e17c33499e4881e18716c99d90963233d3fe8342331c19f2c008d745a28e6202de86874cfa4a078bf76fa881ef029d97e3

  • SSDEEP

    24576:Tgmvjrs+ZWVWo9fsty3xLfD8ugDII/+mLuZ2HV9JaJPlrF:h3ZWTtstQLfDxgDLLuE8PhF

Score
8/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 4 IoCs
    installer
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e10ec89946c23cc52bcc34e8a79713fd6e01d3610834d2b1133d9ece85b9f288.exe
    "C:\Users\Admin\AppData\Local\Temp\e10ec89946c23cc52bcc34e8a79713fd6e01d3610834d2b1133d9ece85b9f288.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Users\Admin\AppData\Local\Temp\nsk6F1C.tmp\DCe10ec89946c23cc52bcc34e8a79713fd6e01d3610834d2b1133d9ece85b9f288.exe
      "C:\Users\Admin\AppData\Local\Temp\nsk6F1C.tmp\DCe10ec89946c23cc52bcc34e8a79713fd6e01d3610834d2b1133d9ece85b9f288.exe" /S
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3384
      • C:\Users\Admin\AppData\Local\Temp\Install_29098\ytd.exe
        C:\Users\Admin\AppData\Local\Temp\Install_29098\ytd.exe /S /aff=defytd1 /rnd=29655
        3⤵
        • Executes dropped EXE
        PID:2944

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Install_29098\ytd.exe
    Filesize

    4.9MB

    MD5

    3d0912d18b58aca1eebc0956dc3c0815

    SHA1

    1fb01f61bb9a0e9db022e8fb4039a8b969faadb7

    SHA256

    013d2d37cffc0b4d0d5ba6b2195619b85c7e0a99a7d977326899062f941256c8

    SHA512

    a71d05a89ef714e75912676c1ea5fbc325ec6c6ae4910c5e91d6dc8488c938296618f229c71a835cdd86715133019adcd7d0389a8eb0681d083616ec0f79640e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Install_29098\ytd.exe
    Filesize

    4.9MB

    MD5

    3d0912d18b58aca1eebc0956dc3c0815

    SHA1

    1fb01f61bb9a0e9db022e8fb4039a8b969faadb7

    SHA256

    013d2d37cffc0b4d0d5ba6b2195619b85c7e0a99a7d977326899062f941256c8

    SHA512

    a71d05a89ef714e75912676c1ea5fbc325ec6c6ae4910c5e91d6dc8488c938296618f229c71a835cdd86715133019adcd7d0389a8eb0681d083616ec0f79640e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsk6F1C.tmp\D1989.dll
    Filesize

    14KB

    MD5

    904beebec2790ee2ca0c90fc448ac7e0

    SHA1

    40fabf1eb0a3b7168351c4514c5288216cb1566d

    SHA256

    f730d9385bf72eac5d579bcf1f7e4330f1d239ca1054d4ead48e9e363d9f4222

    SHA512

    8bdbbaaf73e396cf9fd9866b3e824b7e70c59a2bdefdb3236387e60d0e645d011265fe79fb193f6c0d6abe2e9c01260720c71cd8f068fcc4624760511c54efaa

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsk6F1C.tmp\D1989.dll
    Filesize

    14KB

    MD5

    904beebec2790ee2ca0c90fc448ac7e0

    SHA1

    40fabf1eb0a3b7168351c4514c5288216cb1566d

    SHA256

    f730d9385bf72eac5d579bcf1f7e4330f1d239ca1054d4ead48e9e363d9f4222

    SHA512

    8bdbbaaf73e396cf9fd9866b3e824b7e70c59a2bdefdb3236387e60d0e645d011265fe79fb193f6c0d6abe2e9c01260720c71cd8f068fcc4624760511c54efaa

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsk6F1C.tmp\DCe10ec89946c23cc52bcc34e8a79713fd6e01d3610834d2b1133d9ece85b9f288.exe
    Filesize

    1.1MB

    MD5

    f5e11d91a231cf750cf1579382f6ee03

    SHA1

    20b02b636d8fa3f02c04d2863641a604d0b62a5c

    SHA256

    c6278ee5e7c33ea4738c29c7e1435a713201fe3d1d3519e7a3777f66c8e8e4e0

    SHA512

    017f214631df0e664abb31c80da04a0970c2d54d4e6d737ca81b6ab03bf1edc66183c6e3f84d616849bca8741921cf9c4e96e0b86394cdd53f8ff33eb4763840

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsk6F1C.tmp\DCe10ec89946c23cc52bcc34e8a79713fd6e01d3610834d2b1133d9ece85b9f288.exe
    Filesize

    1.1MB

    MD5

    f5e11d91a231cf750cf1579382f6ee03

    SHA1

    20b02b636d8fa3f02c04d2863641a604d0b62a5c

    SHA256

    c6278ee5e7c33ea4738c29c7e1435a713201fe3d1d3519e7a3777f66c8e8e4e0

    SHA512

    017f214631df0e664abb31c80da04a0970c2d54d4e6d737ca81b6ab03bf1edc66183c6e3f84d616849bca8741921cf9c4e96e0b86394cdd53f8ff33eb4763840

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsk6F1C.tmp\System.dll
    Filesize

    11KB

    MD5

    a436db0c473a087eb61ff5c53c34ba27

    SHA1

    65ea67e424e75f5065132b539c8b2eda88aa0506

    SHA256

    75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

    SHA512

    908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

    Download Submit

  • memory/2620-135-0x0000000002391000-0x0000000002394000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2944-139-0x0000000000000000-mapping.dmp

    Download

  • memory/3384-136-0x0000000000000000-mapping.dmp

    Download