d49a19adab72b2e458655ae976e55d4c8822921d7ab4f4dedd4a6f53c430da5c

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d49a19adab72b2e458655ae976e55d4c8822921d7ab4f4dedd4a6f53c430da5c.exe
Size

5.8MB
MD5

68419528be59565997ce9e54a2e68bb3
SHA1

42af5a516c0cc8269eb0a15d36ff82695b204818
SHA256

d49a19adab72b2e458655ae976e55d4c8822921d7ab4f4dedd4a6f53c430da5c
SHA512

6e329b6c98de4c3267658f18bbef1d08aa284854b2632607a8f769f8d8eb4dcef25dac80ebbac4012d02f0c3831dd4f2305a3174b03163a1243952a14ab3f347
SSDEEP

98304:c48+gQ/GouFoRPZ5USfRprrY3T/KG6oYK1nAOXNwt6biHT:RRguyFoB5fc3rKF47Nc6biHT

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

070E48725C3AB63F.exe

pid process

1492 070E48725C3AB63F.exe

pid	process
1492	070E48725C3AB63F.exe

Loads dropped DLL 2 IoCs

Processes:

d49a19adab72b2e458655ae976e55d4c8822921d7ab4f4dedd4a6f53c430da5c.exe

pid	process
1520	d49a19adab72b2e458655ae976e55d4c8822921d7ab4f4dedd4a6f53c430da5c.exe
1520	d49a19adab72b2e458655ae976e55d4c8822921d7ab4f4dedd4a6f53c430da5c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d49a19adab72b2e458655ae976e55d4c8822921d7ab4f4dedd4a6f53c430da5c.exe

description	pid	process	target process
PID 1520 wrote to memory of 1492	1520	d49a19adab72b2e458655ae976e55d4c8822921d7ab4f4dedd4a6f53c430da5c.exe	070E48725C3AB63F.exe
PID 1520 wrote to memory of 1492	1520	d49a19adab72b2e458655ae976e55d4c8822921d7ab4f4dedd4a6f53c430da5c.exe	070E48725C3AB63F.exe
PID 1520 wrote to memory of 1492	1520	d49a19adab72b2e458655ae976e55d4c8822921d7ab4f4dedd4a6f53c430da5c.exe	070E48725C3AB63F.exe
PID 1520 wrote to memory of 1492	1520	d49a19adab72b2e458655ae976e55d4c8822921d7ab4f4dedd4a6f53c430da5c.exe	070E48725C3AB63F.exe

C:\Users\Admin\AppData\Local\Temp\d49a19adab72b2e458655ae976e55d4c8822921d7ab4f4dedd4a6f53c430da5c.exe
"C:\Users\Admin\AppData\Local\Temp\d49a19adab72b2e458655ae976e55d4c8822921d7ab4f4dedd4a6f53c430da5c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1520

C:\Users\Admin\AppData\Local\Temp\070E48725C3AB63F.exe
"C:\Users\Admin\AppData\Local\Temp\070E48725C3AB63F.exe" 1020
2⤵
- Executes dropped EXE
PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\070E48725C3AB63F.exe

Filesize
719KB

MD5
e3b8d79334b809089aa3e5b22c980085

SHA1
281d9833a060b64fc3a98150a66f85ac5345b85b

SHA256
1c0916ed47557275d46f71903806101726fd458acccc62e776580869bc1b3ca1

SHA512
cc83f4d4e0291b792561f0bf58e991b8f17ae685818ad7ab05c41aa333d38fde1b815d1d6cf62a95039385b94353b5bf6793114547a727cabb8d53dae34bf8f6

Download Submit
\Users\Admin\AppData\Local\Temp\070E48725C3AB63F.exe

Filesize
719KB

MD5
e3b8d79334b809089aa3e5b22c980085

SHA1
281d9833a060b64fc3a98150a66f85ac5345b85b

SHA256
1c0916ed47557275d46f71903806101726fd458acccc62e776580869bc1b3ca1

SHA512
cc83f4d4e0291b792561f0bf58e991b8f17ae685818ad7ab05c41aa333d38fde1b815d1d6cf62a95039385b94353b5bf6793114547a727cabb8d53dae34bf8f6

Download Submit
\Users\Admin\AppData\Local\Temp\070E48725C3AB63F.exe

Filesize
719KB

MD5
e3b8d79334b809089aa3e5b22c980085

SHA1
281d9833a060b64fc3a98150a66f85ac5345b85b

SHA256
1c0916ed47557275d46f71903806101726fd458acccc62e776580869bc1b3ca1

SHA512
cc83f4d4e0291b792561f0bf58e991b8f17ae685818ad7ab05c41aa333d38fde1b815d1d6cf62a95039385b94353b5bf6793114547a727cabb8d53dae34bf8f6

Download Submit
memory/1492-64-0x0000000000000000-mapping.dmp

Download
memory/1520-57-0x0000000002DA0000-0x0000000002F78000-memory.dmp

Filesize
1.8MB

Download
memory/1520-60-0x0000000002DA0000-0x0000000002F78000-memory.dmp

Filesize
1.8MB

Download
memory/1520-61-0x0000000000400000-0x000000000094E000-memory.dmp

Filesize
5.3MB

Download
memory/1520-59-0x0000000000400000-0x000000000094E000-memory.dmp

Filesize
5.3MB

Download
memory/1520-54-0x0000000002DA0000-0x0000000002F78000-memory.dmp

Filesize
1.8MB

Download
memory/1520-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1520-56-0x0000000002DA0000-0x0000000002F78000-memory.dmp

Filesize
1.8MB

Download
memory/1520-67-0x0000000000400000-0x000000000094E000-memory.dmp

Filesize
5.3MB

Download
memory/1520-68-0x0000000002DA0000-0x0000000002F78000-memory.dmp

Filesize
1.8MB

Download