ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114

Analysis

max time kernel
269s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
Size

189KB
MD5

81e6923300e501779f1fdfd86e91894e
SHA1

0ca470457064e30d345b470eff4187267a4dd449
SHA256

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114
SHA512

9589750a6a4875f1e4f067841223d647a09d85461b1f9e6313bb808441a5d5d7c7c55389df96344f4292f50fae1052dfe777915dfd86a6513a30559ac37283f0
SSDEEP

3072:QIWGC7W7BuDcYzI1eqgKJ+BCOcPsbsWNMBHnX65fj7K7ymCwOQH4PWvI40EKX1cb:eGC7W7BUagKaasbsWNMVn4fj2ymTOQHP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

pid process

5024 ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

pid	process
5024	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

description	pid	process	target process
PID 5024 set thread context of 532	5024	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

pid	process
532	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
532	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
532	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
532	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
532	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
532	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
532	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
532	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

pid process

5024 ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

pid	process
5024	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

description	pid	process	target process
PID 5024 wrote to memory of 532	5024	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
PID 5024 wrote to memory of 532	5024	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
PID 5024 wrote to memory of 532	5024	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
PID 5024 wrote to memory of 532	5024	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe	ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe

C:\Users\Admin\AppData\Local\Temp\ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
"C:\Users\Admin\AppData\Local\Temp\ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5024

C:\Users\Admin\AppData\Local\Temp\ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe
"C:\Users\Admin\AppData\Local\Temp\ac1337164b913f3166bc2614e44df949b6c8ce59d18b84f235878d19e36bb114.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstB496.tmp\System.dll

Filesize
11KB

MD5
3e6bf00b3ac976122f982ae2aadb1c51

SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

Download Submit
memory/532-134-0x0000000000000000-mapping.dmp

Download
memory/532-135-0x00000000001D0000-0x00000000001DF000-memory.dmp

Filesize
60KB

Download
memory/532-137-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/532-141-0x00000000001D0000-0x00000000001DF000-memory.dmp

Filesize
60KB

Download
memory/5024-133-0x00000000022C0000-0x00000000022D2000-memory.dmp

Filesize
72KB

Download
memory/5024-136-0x00000000022C0000-0x00000000022D2000-memory.dmp

Filesize
72KB

Download