39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3

Analysis

max time kernel
163s
max time network
223s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe
Size

61KB
MD5

0c4062ff7f5a7bc41246cc1ade4ce84a
SHA1

09ac772b7a5c33c72289ee792fcb9b3494bf0258
SHA256

39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3
SHA512

2a3b9c6ac502505e7192972b9632f4f443a72169bc969753c336d70c257b3a1376067ba29ced97be038cbbfe84c273a9379342c5d989ad8ec94fdf8f8c47603d
SSDEEP

1536:h4UHxpN/MUXsLTvCj0DBXJaOADnsqgW5qbPnFkbbbWyLZe:h4URpNUUX6z/DBXJfADsqgW5qbWbCuZe

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1644	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1644 set thread context of 3108	1644	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 3108	1644	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	80
PID 1644 wrote to memory of 3108	1644	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	80
PID 1644 wrote to memory of 3108	1644	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	80
PID 1644 wrote to memory of 3108	1644	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	80
PID 1644 wrote to memory of 3108	1644	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	80
PID 1644 wrote to memory of 3108	1644	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	80
PID 1644 wrote to memory of 3108	1644	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	80

C:\Users\Admin\AppData\Local\Temp\39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe
"C:\Users\Admin\AppData\Local\Temp\39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe
  "C:\Users\Admin\AppData\Local\Temp\39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe"
  2⤵
  PID:3108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nskA067.tmp\emarginations.dll

Filesize
13KB

MD5
9dfea6dd26dd7928deef806d5b314ec9

SHA1
a5abea6ea350a454873ddb8cda88e4b3023253ff

SHA256
cbe896a3873fa9172ad87d4dd47f2178291e83a8f9329f268bf870d585be0df8

SHA512
c004d2357841745f487deb5c2df9223db70cdfced48dcd11effd06c9b923919ff2b6e3438914858fa0f434525d9694545920d8bd65726901dd1c098310718726

Download Submit
memory/3108-134-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download