5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306

Analysis

max time kernel
202s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe
Size

171KB
MD5

aeaca792d865f50ee85754a74a1f2ff2
SHA1

25ce8282ec805060d7cb04046fad00c22ac1759a
SHA256

5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306
SHA512

1f22ad16f1ba6af24d563f7b46c203469913f5acc1a18693241db6ce2d9b86ecfc904a3f18fce1d727f0b6178a4b8a80da2a64a151309d49cc57902ac4c57764
SSDEEP

3072:h3c1fP4AJJEAeqwKN+BCXtY+efAS6e1pfQKaEjZT6J9SNgH3uGguslH5WR0lc:FOPjwUwKFK4SPJT6PEgXKvH5Muc

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 9 IoCs

Processes:

5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe

pid	process
2008	5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe
2008	5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe
2008	5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe
2008	5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe
2008	5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe
2008	5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe
2008	5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe
2008	5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe
2008	5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nso5E4E.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nso5E4E.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe

description	pid	process	target process
PID 2008 wrote to memory of 4732	2008	5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe	cmd.exe
PID 2008 wrote to memory of 4732	2008	5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe	cmd.exe
PID 2008 wrote to memory of 4732	2008	5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe
"C:\Users\Admin\AppData\Local\Temp\5a3f0e8acc22a9959703b96385d95345fdf1b9174e524068f49c94a526104306.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C copy /b "KeLe2014Beta3.6.2Promote0326_20090195130.exe" + "C:\Windows\Fonts\SIMSUN.TTC" "KeLe2014Beta3.6.2Promote0326_20090195130.exe"
2⤵
PID:4732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso5E4E.tmp\Base64.dll
Filesize
4KB

MD5
f0e3845fefd227d7f1101850410ec849

SHA1
3067203fafd4237be0c186ddab7029dfcbdfb53e

SHA256
7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

SHA512
584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5E4E.tmp\Base64.dll
Filesize
4KB

MD5
f0e3845fefd227d7f1101850410ec849

SHA1
3067203fafd4237be0c186ddab7029dfcbdfb53e

SHA256
7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

SHA512
584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5E4E.tmp\ExecCmd.dll
Filesize
4KB

MD5
b9380b0bea8854fd9f93cc1fda0dfeac

SHA1
edb8d58074e098f7b5f0d158abedc7fc53638618

SHA256
1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244

SHA512
45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5E4E.tmp\ExecCmd.dll
Filesize
4KB

MD5
b9380b0bea8854fd9f93cc1fda0dfeac

SHA1
edb8d58074e098f7b5f0d158abedc7fc53638618

SHA256
1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244

SHA512
45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5E4E.tmp\Inetc.dll
Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5E4E.tmp\Inetc.dll
Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5E4E.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
Filesize
26.1MB

MD5
d7879fe854aa6ce817a337543ca8f6bd

SHA1
c3275dfbb60e4736b8e560b9373be53281168e15

SHA256
7b17bb3879ae0591027ba6d9f45559fe0f9fb3cfe163f2de00b88572b92c4a5b

SHA512
727f393e39e48d1af0530b7852c980059d6400a70c2f11841bdba4f183d6506ed604f8d7db2e1dfc34c3f71ac62dd9beca36a30ba9a304410d2deb0c340073b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5E4E.tmp\NSISdl.dll
Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5E4E.tmp\NSISdl.dll
Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5E4E.tmp\System.dll
Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
memory/2008-140-0x0000000000441000-0x0000000000444000-memory.dmp

Filesize
12KB

Download
memory/2008-135-0x00000000022A1000-0x00000000022A4000-memory.dmp

Filesize
12KB

Download
memory/4732-143-0x0000000000000000-mapping.dmp

Download