a483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2

General

Target

a483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
Size

1.4MB
MD5

301d4ec79daaa1283536f610fce07f11
SHA1

a1ff063fa1be7a62eb43f25eca1ca7be46523a35
SHA256

a483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2
SHA512

08957f536f1ea6299a9668e41ecbbe6bf3a7c1cdab0f1d647cca5fbb708b87f669baf8956c926373a7d22f890b3af4a804e549460b4712a9915de985ab73443b
SSDEEP

24576:fDPyWJlJG1xNGwyivboY2/xfxu1B1+cs88mbBi0YXU04GbObyv+9+075jKKFEooG:TRJChHXy41VYXUd6+9+g5jfk4

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe

Loads dropped DLL 3 IoCs

pid	Process
2044	a483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
2044	a483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
2044	a483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
1788	DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1788	2044	a483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe	28
PID 2044 wrote to memory of 1788	2044	a483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe	28
PID 2044 wrote to memory of 1788	2044	a483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe	28
PID 2044 wrote to memory of 1788	2044	a483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe	28

C:\Users\Admin\AppData\Local\Temp\a483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
"C:\Users\Admin\AppData\Local\Temp\a483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\nsd592B.tmp\DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe
  "C:\Users\Admin\AppData\Local\Temp\nsd592B.tmp\DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd592B.tmp\DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe

Filesize
1.4MB

MD5
5c4da96fe72ded3865f6cc597ee3c1fc

SHA1
b6dcfd830cc366f95e319d63db675b783657c12d

SHA256
f0edf8e1b1f0424ef43d6dc5552dd276da594e9a200e6f163f65460d0e65c096

SHA512
5c7d82cf125177252c8e62a6d97f5d6dafda502c240d05d085edb102b7933578f2ca2522c1879012b4193e1a93cf36afcecbbf0757dc749a1cfede271e3f26ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd592B.tmp\DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe

Filesize
1.4MB

MD5
5c4da96fe72ded3865f6cc597ee3c1fc

SHA1
b6dcfd830cc366f95e319d63db675b783657c12d

SHA256
f0edf8e1b1f0424ef43d6dc5552dd276da594e9a200e6f163f65460d0e65c096

SHA512
5c7d82cf125177252c8e62a6d97f5d6dafda502c240d05d085edb102b7933578f2ca2522c1879012b4193e1a93cf36afcecbbf0757dc749a1cfede271e3f26ca

Download Submit
\Users\Admin\AppData\Local\Temp\nsd592B.tmp\D1989.dll

Filesize
14KB

MD5
904beebec2790ee2ca0c90fc448ac7e0

SHA1
40fabf1eb0a3b7168351c4514c5288216cb1566d

SHA256
f730d9385bf72eac5d579bcf1f7e4330f1d239ca1054d4ead48e9e363d9f4222

SHA512
8bdbbaaf73e396cf9fd9866b3e824b7e70c59a2bdefdb3236387e60d0e645d011265fe79fb193f6c0d6abe2e9c01260720c71cd8f068fcc4624760511c54efaa

Download Submit
\Users\Admin\AppData\Local\Temp\nsd592B.tmp\DCa483d47d7b715a0779c474883931c953594fafac34a0159f3720a8e1588f2de2.exe

Filesize
1.4MB

MD5
5c4da96fe72ded3865f6cc597ee3c1fc

SHA1
b6dcfd830cc366f95e319d63db675b783657c12d

SHA256
f0edf8e1b1f0424ef43d6dc5552dd276da594e9a200e6f163f65460d0e65c096

SHA512
5c7d82cf125177252c8e62a6d97f5d6dafda502c240d05d085edb102b7933578f2ca2522c1879012b4193e1a93cf36afcecbbf0757dc749a1cfede271e3f26ca

Download Submit
\Users\Admin\AppData\Local\Temp\nsd592B.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
memory/2044-54-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing