Analysis
-
max time kernel
179s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 04:06
Static task
static1
Behavioral task
behavioral1
Sample
db37403bc5bdfe1ca257d607f4e67b8226c0193671f6ef37e2cfe93516eaf48c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
db37403bc5bdfe1ca257d607f4e67b8226c0193671f6ef37e2cfe93516eaf48c.exe
Resource
win10v2004-20220812-en
General
-
Target
db37403bc5bdfe1ca257d607f4e67b8226c0193671f6ef37e2cfe93516eaf48c.exe
-
Size
1.7MB
-
MD5
31cfe1471edd6c3dda080ecc6a540557
-
SHA1
5097b2f3d7742d4654b6ea40e254ab94346bb472
-
SHA256
db37403bc5bdfe1ca257d607f4e67b8226c0193671f6ef37e2cfe93516eaf48c
-
SHA512
e08ab254d31299e680770bb09d536bba01e50818e3c838d537105ba0ad00a7cf2cd3d462cb958add044b440bb79aa3e12edc10dfc57e713791f6e8b4b1561af8
-
SSDEEP
49152:B6diwOan5CuGPUkfgDNJ5RjPGuflnmrv794zl:kdic4USgBJDGMorDG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
is-SKDL3.tmppid process 4364 is-SKDL3.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
db37403bc5bdfe1ca257d607f4e67b8226c0193671f6ef37e2cfe93516eaf48c.exedescription pid process target process PID 2700 wrote to memory of 4364 2700 db37403bc5bdfe1ca257d607f4e67b8226c0193671f6ef37e2cfe93516eaf48c.exe is-SKDL3.tmp PID 2700 wrote to memory of 4364 2700 db37403bc5bdfe1ca257d607f4e67b8226c0193671f6ef37e2cfe93516eaf48c.exe is-SKDL3.tmp PID 2700 wrote to memory of 4364 2700 db37403bc5bdfe1ca257d607f4e67b8226c0193671f6ef37e2cfe93516eaf48c.exe is-SKDL3.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\db37403bc5bdfe1ca257d607f4e67b8226c0193671f6ef37e2cfe93516eaf48c.exe"C:\Users\Admin\AppData\Local\Temp\db37403bc5bdfe1ca257d607f4e67b8226c0193671f6ef37e2cfe93516eaf48c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MHO06.tmp\is-SKDL3.tmp"C:\Users\Admin\AppData\Local\Temp\is-MHO06.tmp\is-SKDL3.tmp" /SL4 $1A0022 "C:\Users\Admin\AppData\Local\Temp\db37403bc5bdfe1ca257d607f4e67b8226c0193671f6ef37e2cfe93516eaf48c.exe" 1520567 727042⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-MHO06.tmp\is-SKDL3.tmpFilesize
656KB
MD5e9f9fc2b5ca4d66d2e0d8958e6e1fff5
SHA1473730f6a63abe99eafb278d2d178ed79ae3ac10
SHA25673deec1971561033c817697a86b2df5bdd533290f42dbbc6b472697d5120469f
SHA512a9a0deb4e83fc1878d9e9d468253b641b9b4892f2fe47c19a4b09f9ff4a79fe8982d31a4cec416ff4b24fe84ff31fb60222e45b13bf7d5975a9f024cc19b146c
-
C:\Users\Admin\AppData\Local\Temp\is-MHO06.tmp\is-SKDL3.tmpFilesize
656KB
MD5e9f9fc2b5ca4d66d2e0d8958e6e1fff5
SHA1473730f6a63abe99eafb278d2d178ed79ae3ac10
SHA25673deec1971561033c817697a86b2df5bdd533290f42dbbc6b472697d5120469f
SHA512a9a0deb4e83fc1878d9e9d468253b641b9b4892f2fe47c19a4b09f9ff4a79fe8982d31a4cec416ff4b24fe84ff31fb60222e45b13bf7d5975a9f024cc19b146c
-
memory/2700-132-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2700-137-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4364-134-0x0000000000000000-mapping.dmp