2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
Size

63KB
MD5

917e09110e1125c5bbf095e6ce7e3237
SHA1

d5878d817ad210fbae27715835fc1d5e1d05fd6f
SHA256

2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d
SHA512

aa2b6974a3def96e8c69943695962b17a078bde309f9f938d515e5bb19c247e00cdb4e9dcb472743faa4dfc126fc7b36d0d009c6b6580f2cc9dc3f25ed6265ba
SSDEEP

1536:cumhxebkJf+FTXJLzr+lOdj2cPD2aXFmMtu:cuxkZuTXJKMdjJ6aXFmM8

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

mf.exeef.exe

pid process

4976 mf.exe
388 ef.exe

pid	process
4976	mf.exe
388	ef.exe

Loads dropped DLL 21 IoCs

Processes:

2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe

pid	process
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe

description	pid	process	target process
PID 4964 wrote to memory of 4976	4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	mf.exe
PID 4964 wrote to memory of 4976	4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	mf.exe
PID 4964 wrote to memory of 4976	4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	mf.exe
PID 4964 wrote to memory of 388	4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	ef.exe
PID 4964 wrote to memory of 388	4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	ef.exe
PID 4964 wrote to memory of 388	4964	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	ef.exe

C:\Users\Admin\AppData\Local\Temp\2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
"C:\Users\Admin\AppData\Local\Temp\2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\mf.exe
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\mf.exe "C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll"
2⤵
- Executes dropped EXE
PID:4976

C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\ef.exe
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\ef.exe "C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll" -968
2⤵
- Executes dropped EXE
PID:388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\ef.exe

Filesize
2KB

MD5
b8a00d99534bf83442b20b2474b767cf

SHA1
505d3f6591db0f87a73a0ac820cc2eba5171cfff

SHA256
cc6d58b72d806d7f314d31fbea1fd3b72708b2f9dd6d7203e12cf0e076337af6

SHA512
75df70621957af1bb2c072ca76cd6f9c5cd92d11e54691daa87d37c0c8bdad5979f8679b49e3e5fc5aa83081ef7b85e6b46393a0877520583d7cca43874ebbd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\ef.exe

Filesize
2KB

MD5
b8a00d99534bf83442b20b2474b767cf

SHA1
505d3f6591db0f87a73a0ac820cc2eba5171cfff

SHA256
cc6d58b72d806d7f314d31fbea1fd3b72708b2f9dd6d7203e12cf0e076337af6

SHA512
75df70621957af1bb2c072ca76cd6f9c5cd92d11e54691daa87d37c0c8bdad5979f8679b49e3e5fc5aa83081ef7b85e6b46393a0877520583d7cca43874ebbd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll.out

Filesize
20KB

MD5
89d90cbab6d0718cfea2bb1865f0dc28

SHA1
bd947ae55ae1a95a3c2423300f6b4f8398d23c79

SHA256
4bc01e1cbbe34b80c8c9daf6e4a5a346250dae8c6ec73db26acf6085d7b1e962

SHA512
f95ca2dc462a419458e5c0ce6140d2fe9a689817faee7bc8a87fbe7da4a4e423784616cfc20bf65ad55d3d18a6dd4662639ec83cb0220a041d79b6cc304422c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll.out

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll.out0

Filesize
10KB

MD5
4f1bc6b4466a9b84113842660e7de483

SHA1
04d05739c6ed3df896626d59d5391a699cf8cb11

SHA256
9764622c9bb81321763b246a71f6e337e082457655f660d705d83b868eb550d1

SHA512
9e2ce520010cdd390f8f1c8004795b3618e7ad1fd538b20fbfcf031495ecc6841ec9a6f21d16a963c35569aa7ecc40ecc1b0fba152c0a35ad998a2a743e96d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\inetc.dll.out1

Filesize
10KB

MD5
37068846f9ee2ebd355b27b0abf0e6fc

SHA1
6fb5eb553ccfa74751ba4c7a5381b125fb829f02

SHA256
fba508e890edb803f6a2323cffa332ba13577c3957d57d31de6bcafa11b5070c

SHA512
ada09d0bb0a8f523c892144328cfcaa8d8f0f94049ed10edca92713134f9ca0d3f68ed384ab8b3b8e6f55a6462d6181ab0a7e7df617f04d3e31c1fb06af00ce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\mf.exe

Filesize
2KB

MD5
224df7127c7ee69e67380eefc983a6ff

SHA1
236c342c5bd1f71725534d097fcd8538dd95aa56

SHA256
9ca35b84699aff2125cbe775c0731e69dad1d667d3ceec6db59c954dd9c83965

SHA512
c238c9fb0285eadd63e9f819b4aead95d88f312ef2a11749a879ba105a0c590e23e2def83f9cd8860744b9307bf12c71fbffbb482fa143e3b13b7934c23df80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\mf.exe

Filesize
2KB

MD5
224df7127c7ee69e67380eefc983a6ff

SHA1
236c342c5bd1f71725534d097fcd8538dd95aa56

SHA256
9ca35b84699aff2125cbe775c0731e69dad1d667d3ceec6db59c954dd9c83965

SHA512
c238c9fb0285eadd63e9f819b4aead95d88f312ef2a11749a879ba105a0c590e23e2def83f9cd8860744b9307bf12c71fbffbb482fa143e3b13b7934c23df80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAED5.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
memory/388-146-0x0000000000000000-mapping.dmp

Download
memory/4964-152-0x0000000002411000-0x0000000002414000-memory.dmp

Filesize
12KB

Download
memory/4964-161-0x0000000000571000-0x0000000000574000-memory.dmp

Filesize
12KB

Download
memory/4976-138-0x0000000000000000-mapping.dmp

Download