d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436

General

Target

d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe
Size

326KB
MD5

2851cd2b3e31313210e48683eb61fe8d
SHA1

350692e46b4e2fd96b4da4054bf763ad27c80dca
SHA256

d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436
SHA512

8e5679ce4730ed1feb2f68538b250eebd2bb6a7e0961109df6da2c67124a13722929fa9522b496177ece6453f41622d062a078a8003a5abfda8357986c16e295
SSDEEP

6144:ts8xRvSQBOVAQq5bCu7ZvESHicH8JRCzU28UPhyUICE:TvnQANlCEZOu8J8FJhg/

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

¼ÓÊôÐÔµã»÷Æ÷.exe

pid process

692 ¼ÓÊôÐÔµã»÷Æ÷.exe

pid	process
692	¼ÓÊôÐÔµã»÷Æ÷.exe

Loads dropped DLL 5 IoCs

Processes:

d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe¼ÓÊôÐÔµã»÷Æ÷.exe

pid	process
956	d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe
956	d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe
956	d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe
692	¼ÓÊôÐÔµã»÷Æ÷.exe
692	¼ÓÊôÐÔµã»÷Æ÷.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe

description	pid	process	target process
PID 956 wrote to memory of 692	956	d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe	¼ÓÊôÐÔµã»÷Æ÷.exe
PID 956 wrote to memory of 692	956	d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe	¼ÓÊôÐÔµã»÷Æ÷.exe
PID 956 wrote to memory of 692	956	d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe	¼ÓÊôÐÔµã»÷Æ÷.exe
PID 956 wrote to memory of 692	956	d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe	¼ÓÊôÐÔµã»÷Æ÷.exe
PID 956 wrote to memory of 692	956	d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe	¼ÓÊôÐÔµã»÷Æ÷.exe
PID 956 wrote to memory of 692	956	d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe	¼ÓÊôÐÔµã»÷Æ÷.exe
PID 956 wrote to memory of 692	956	d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe	¼ÓÊôÐÔµã»÷Æ÷.exe

C:\Users\Admin\AppData\Local\Temp\d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe
"C:\Users\Admin\AppData\Local\Temp\d2536ce3501b78315a80ae2bd0ed8adc260069d30b9e4201b61b8ed531bc5436.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:956

C:\Users\Admin\AppData\Local\Temp\¼ÓÊôÐÔµã»÷Æ÷.exe
"C:\Users\Admin\AppData\Local\Temp\¼ÓÊôÐÔµã»÷Æ÷.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\¼ÓÊôÐÔµã»÷Æ÷.exe

Filesize
76KB

MD5
c0644a7b32de641e4ca9aa9aee4e0826

SHA1
c78bda79dbb2677192d2cbd0618ff48378b697d5

SHA256
cf5dd2ecdea78fbea4dc9bb58a73229da79ca32d77fa474d96c2861a64e3b431

SHA512
8039935c14ef01f2ede3e6420678af18055553aea1f816012f6b4a0de5eeb65062251602812db9e20453f59eeefe24bd27ef49dfee83d667fc6dff06b02864e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\¼ÓÊôÐÔµã»÷Æ÷.exe

Filesize
76KB

MD5
c0644a7b32de641e4ca9aa9aee4e0826

SHA1
c78bda79dbb2677192d2cbd0618ff48378b697d5

SHA256
cf5dd2ecdea78fbea4dc9bb58a73229da79ca32d77fa474d96c2861a64e3b431

SHA512
8039935c14ef01f2ede3e6420678af18055553aea1f816012f6b4a0de5eeb65062251602812db9e20453f59eeefe24bd27ef49dfee83d667fc6dff06b02864e0

Download Submit
\Users\Admin\AppData\Local\Temp\nsoB59C.tmp\AdvSplash.dll

Filesize
6KB

MD5
a1bba35c752b36f575350cb7ddf238e4

SHA1
9603b691ae71d4fbc7a14dbb837bd97cecac8aab

SHA256
0667863d71a3021ab844069b6dd0485f874bf638af478ab11c6fb8b7d6c834b6

SHA512
eb5d3498dd994bec42a437cf91343665d3c35bfe3f6277a7393af6a0b8348772c3166d9be48955edddf6ef79fa508ec8d4f96d7d5df37ecdc52c90042e0a2967

Download Submit
\Users\Admin\AppData\Local\Temp\nsoB59C.tmp\NSISdl.dll

Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
\Users\Admin\AppData\Local\Temp\¼ÓÊôÐÔµã»÷Æ÷.exe

Filesize
76KB

MD5
c0644a7b32de641e4ca9aa9aee4e0826

SHA1
c78bda79dbb2677192d2cbd0618ff48378b697d5

SHA256
cf5dd2ecdea78fbea4dc9bb58a73229da79ca32d77fa474d96c2861a64e3b431

SHA512
8039935c14ef01f2ede3e6420678af18055553aea1f816012f6b4a0de5eeb65062251602812db9e20453f59eeefe24bd27ef49dfee83d667fc6dff06b02864e0

Download Submit
\Users\Admin\AppData\Local\Temp\¼ÓÊôÐÔµã»÷Æ÷.exe

Filesize
76KB

MD5
c0644a7b32de641e4ca9aa9aee4e0826

SHA1
c78bda79dbb2677192d2cbd0618ff48378b697d5

SHA256
cf5dd2ecdea78fbea4dc9bb58a73229da79ca32d77fa474d96c2861a64e3b431

SHA512
8039935c14ef01f2ede3e6420678af18055553aea1f816012f6b4a0de5eeb65062251602812db9e20453f59eeefe24bd27ef49dfee83d667fc6dff06b02864e0

Download Submit
\Users\Admin\AppData\Local\Temp\¼ÓÊôÐÔµã»÷Æ÷.exe

Filesize
76KB

MD5
c0644a7b32de641e4ca9aa9aee4e0826

SHA1
c78bda79dbb2677192d2cbd0618ff48378b697d5

SHA256
cf5dd2ecdea78fbea4dc9bb58a73229da79ca32d77fa474d96c2861a64e3b431

SHA512
8039935c14ef01f2ede3e6420678af18055553aea1f816012f6b4a0de5eeb65062251602812db9e20453f59eeefe24bd27ef49dfee83d667fc6dff06b02864e0

Download Submit
memory/692-58-0x0000000000000000-mapping.dmp

Download
memory/956-54-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing