64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4

General

Target

64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
Size

1.1MB
MD5

7715ef34080929979297161e287c9714
SHA1

a498a940488ad64404cca28cabf2a7dac0c02b6b
SHA256

64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4
SHA512

d6e353c1222b79dd1b294ac8deae213546d6f5ed707b30226f374fc21e1d8d88e695d8c9c48d4f78b70ac6d5ded28f46daac418cd82200a458d9d06f21d6d613
SSDEEP

24576:LiDGg0cMTQyifO13O7+dZOtiKfZ2UsAPZGCDZKTKaNU4w:D3cMGGhOyZkisZdJaHw

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe

Loads dropped DLL 3 IoCs

pid	Process
1088	64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
1088	64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
1088	64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
384	DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 384	1088	64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe	27
PID 1088 wrote to memory of 384	1088	64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe	27
PID 1088 wrote to memory of 384	1088	64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe	27
PID 1088 wrote to memory of 384	1088	64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe	27

C:\Users\Admin\AppData\Local\Temp\64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
"C:\Users\Admin\AppData\Local\Temp\64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\nsj19CB.tmp\DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe
  "C:\Users\Admin\AppData\Local\Temp\nsj19CB.tmp\DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsj19CB.tmp\DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe

Filesize
1.1MB

MD5
b0e578be56d4a471a0738a18fc0eb507

SHA1
e3ff7d4b56668864aef9a0c1b9062ef5a388d013

SHA256
f136c13071c6fd9a4df5c6f533d212db4b4ee3e734ace10d36c05345f0d5c111

SHA512
32e6a69f034678132a7015d5ee5a338c5164632737e77309a25a568f7b258b4fdd08333bd22bb3b9b02c662ac915f04726242e9c0dd204615ce822e86874a031

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj19CB.tmp\DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe

Filesize
1.1MB

MD5
b0e578be56d4a471a0738a18fc0eb507

SHA1
e3ff7d4b56668864aef9a0c1b9062ef5a388d013

SHA256
f136c13071c6fd9a4df5c6f533d212db4b4ee3e734ace10d36c05345f0d5c111

SHA512
32e6a69f034678132a7015d5ee5a338c5164632737e77309a25a568f7b258b4fdd08333bd22bb3b9b02c662ac915f04726242e9c0dd204615ce822e86874a031

Download Submit
\Users\Admin\AppData\Local\Temp\nsj19CB.tmp\D1989.dll

Filesize
14KB

MD5
904beebec2790ee2ca0c90fc448ac7e0

SHA1
40fabf1eb0a3b7168351c4514c5288216cb1566d

SHA256
f730d9385bf72eac5d579bcf1f7e4330f1d239ca1054d4ead48e9e363d9f4222

SHA512
8bdbbaaf73e396cf9fd9866b3e824b7e70c59a2bdefdb3236387e60d0e645d011265fe79fb193f6c0d6abe2e9c01260720c71cd8f068fcc4624760511c54efaa

Download Submit
\Users\Admin\AppData\Local\Temp\nsj19CB.tmp\DC64f704131796a82a6a41bee8d898470293f11a4750d2628c7750475efc1465b4.exe

Filesize
1.1MB

MD5
b0e578be56d4a471a0738a18fc0eb507

SHA1
e3ff7d4b56668864aef9a0c1b9062ef5a388d013

SHA256
f136c13071c6fd9a4df5c6f533d212db4b4ee3e734ace10d36c05345f0d5c111

SHA512
32e6a69f034678132a7015d5ee5a338c5164632737e77309a25a568f7b258b4fdd08333bd22bb3b9b02c662ac915f04726242e9c0dd204615ce822e86874a031

Download Submit
\Users\Admin\AppData\Local\Temp\nsj19CB.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
memory/1088-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing