f1c30b378d3eef6e701672f8af445260991df54f18a922ef13759c83e64386da

Analysis

max time kernel
2s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

payment_copy4_receipt.exe
Size

535KB
MD5

9c00e5d71c6c53c475e416ce9a99c09f
SHA1

2b38c81029cd53a3bb8d6c250f67d77b4f7b565d
SHA256

f1c30b378d3eef6e701672f8af445260991df54f18a922ef13759c83e64386da
SHA512

9b4970b6669fb196ed9ca6f906c94e0e7d417dbb87e96a513cd75d01514035ce479aa94f0c7fcd50cd66a6a2b00555723af4432192c117a5836f6c456d5ab2c4
SSDEEP

6144:lBnlWGbq9Dey0ua8QMaDeQ0mjqKzu6ueVivo3+QivOqN:w9aeErDaylRuuIJvD

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

kwlekmutmm.exe

pid process

856 kwlekmutmm.exe
Loads dropped DLL 1 IoCs

Processes:

payment_copy4_receipt.exe

pid process

1232 payment_copy4_receipt.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
856	kwlekmutmm.exe

pid	process
1232	payment_copy4_receipt.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

payment_copy4_receipt.exe

description	pid	process	target process
PID 1232 wrote to memory of 856	1232	payment_copy4_receipt.exe	kwlekmutmm.exe
PID 1232 wrote to memory of 856	1232	payment_copy4_receipt.exe	kwlekmutmm.exe
PID 1232 wrote to memory of 856	1232	payment_copy4_receipt.exe	kwlekmutmm.exe
PID 1232 wrote to memory of 856	1232	payment_copy4_receipt.exe	kwlekmutmm.exe

C:\Users\Admin\AppData\Local\Temp\payment_copy4_receipt.exe
"C:\Users\Admin\AppData\Local\Temp\payment_copy4_receipt.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1232

C:\Users\Admin\AppData\Local\Temp\kwlekmutmm.exe
"C:\Users\Admin\AppData\Local\Temp\kwlekmutmm.exe" C:\Users\Admin\AppData\Local\Temp\wlkaev.ssw
2⤵
- Executes dropped EXE
PID:856

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kwlekmutmm.exe
Filesize
122KB

MD5
b36a20f9ca4409b58323346ac424acd4

SHA1
a0faf11adc147bdc4971fcddd5369dcb441f6946

SHA256
94944cde59010d13e199cfa5262af09490dcc41b1b9e2cb991275233665c98cf

SHA512
efcd83a66785d4c6f74e7d7b10adb65f96015e2fc335eb28b31853eb9844064eda47aef2fc0f5398bdbf0a57af5e5f98bfa063cd0f3b44da65324bb420e33ffe

Download Submit
\Users\Admin\AppData\Local\Temp\kwlekmutmm.exe
Filesize
122KB

MD5
b36a20f9ca4409b58323346ac424acd4

SHA1
a0faf11adc147bdc4971fcddd5369dcb441f6946

SHA256
94944cde59010d13e199cfa5262af09490dcc41b1b9e2cb991275233665c98cf

SHA512
efcd83a66785d4c6f74e7d7b10adb65f96015e2fc335eb28b31853eb9844064eda47aef2fc0f5398bdbf0a57af5e5f98bfa063cd0f3b44da65324bb420e33ffe

Download Submit
memory/856-56-0x0000000000000000-mapping.dmp

Download
memory/1232-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download