Overview

overview

8

Static

static

8

mxdbl.pc6....68.exe

windows7-x64

7

mxdbl.pc6....68.exe

windows10-2004-x64

7

mxdbl.pc6....ti.dll

windows7-x64

1

mxdbl.pc6....ti.dll

windows10-2004-x64

1

mxdbl.pc6....��.url

windows7-x64

1

mxdbl.pc6....��.url

windows10-2004-x64

1

mxdbl.pc6....er.dll

windows7-x64

8

mxdbl.pc6....er.dll

windows10-2004-x64

8

mxdbl.pc6....32.dll

windows7-x64

1

mxdbl.pc6....32.dll

windows10-2004-x64

1

mxdbl.pc6....��.chm

windows7-x64

1

mxdbl.pc6....��.chm

windows10-2004-x64

1

mxdbl.pc6....��.exe

windows7-x64

8

mxdbl.pc6....��.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    369s
  • max time network
    449s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 21:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    mxdbl.pc6.0831/冒险伴侣0831/Baidu_Com_90000168.exe

  • Size

    1.4MB

  • MD5

    d49e4198096aa6f7af3787ba230198c2

  • SHA1

    e7a3c4feb071ec294ce14d74f6e0fa603740f1af

  • SHA256

    2343e15558bba1e08369527cebd7082495c4fb5f1f859f1806f4ac0b464cd304

  • SHA512

    a36ba06bdf98783b33d30b3f87854387493de077a679105ebb4af9e29df809e623738fab5014109e44d5965e8c07173e9f57c92fb1e02dc6b57b03095988dfa1

  • SSDEEP

    24576:eCNjeWLiBF5Addz/++bJnksHBmNqvdOg5m8y01HHiaqulkrpsEG3eX:DjNLsFybzhkaBmNWdN5HyLHekeEG3+

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\mxdbl.pc6.0831\冒险伴侣0831\Baidu_Com_90000168.exe
    "C:\Users\Admin\AppData\Local\Temp\mxdbl.pc6.0831\冒险伴侣0831\Baidu_Com_90000168.exe"
    1⤵
    • Loads dropped DLL
    PID:3816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsaCC0.tmp\BDMSkin.dll
    Filesize

    1.3MB

    MD5

    b540a866191f7fd20f5e6355bc2b094e

    SHA1

    df01a0c011e88a1f860db41d474d3fe893f06082

    SHA256

    ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

    SHA512

    e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsaCC0.tmp\BDMSkin.dll
    Filesize

    1.3MB

    MD5

    b540a866191f7fd20f5e6355bc2b094e

    SHA1

    df01a0c011e88a1f860db41d474d3fe893f06082

    SHA256

    ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

    SHA512

    e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsaCC0.tmp\tmpxblgiy.dll
    Filesize

    620KB

    MD5

    e0d8d0a69ce5eeb83594d4517afa54f6

    SHA1

    b34de8329a7c014d3cf3f5fe6d9d8e679d4918fd

    SHA256

    ba9e1a46344846aa2138c970f6581fd364bc9369fdbb9402199589fe0645abf0

    SHA512

    ab7c752abb37165edff8e389f8ee0ac48149c9092decf347989df4ab47e5dd5046c131a74b1e35e15c31f6f95cc69ebd05c8d41162788a151f78e2d9025ca4a7

    Download Submit
  • memory/3816-135-0x0000000003200000-0x0000000003343000-memory.dmp
    Filesize

    1.3MB

    Download