2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf

General

Target

2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe
Size

1000KB
MD5

a2cb3c05eeca6c3fb74a55e97227134e
SHA1

3c826530b25e2cf5d409539bcdb88023f12da3c4
SHA256

2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf
SHA512

94f90d3ba79b3cc1c8e775ab8dc1a4eeea084e8cce7467bf40fe24854b4d968499b50b83833c23da4f69dc5995a1dde671f3a2ffe51c046cda6adaf72b1ddfcd
SSDEEP

24576:v/p0Y15t+4j12P1r9minvrhKp0K/Y5sPWdYFeL0DKEWqbKbFMrdJDGih1:3p15VjW0invrbKUvCeQDK1qbCFMrnDz1

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
572	2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp

Loads dropped DLL 3 IoCs

pid	Process
1484	2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe
572	2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp
572	2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
572	2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 572	1484	2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe	28
PID 1484 wrote to memory of 572	1484	2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe	28
PID 1484 wrote to memory of 572	1484	2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe	28
PID 1484 wrote to memory of 572	1484	2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe	28

C:\Users\Admin\AppData\Local\Temp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe
"C:\Users\Admin\AppData\Local\Temp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Local\Temp\is-904S2.tmp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-904S2.tmp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp" /SL5="$70122,763131,52224,C:\Users\Admin\AppData\Local\Temp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-904S2.tmp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp

Filesize
660KB

MD5
aa1e9eec51c34d68b3fae2caf4bea3f2

SHA1
ccd2381cff17acbb0adc0c6f409d6df8346c3803

SHA256
2575430608f57e268eb5fc7842aff36bd5506af1d413a02e829920fab72e7e44

SHA512
7ea3747779213df50e3e0b55eae0abb20eeebe20ec8ceb630f8aa93e637889cda7f313c683900748c69e2ee0b66117504fbeee5dbf1ee8e71f096b79b5fa6497

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-904S2.tmp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp

Filesize
660KB

MD5
aa1e9eec51c34d68b3fae2caf4bea3f2

SHA1
ccd2381cff17acbb0adc0c6f409d6df8346c3803

SHA256
2575430608f57e268eb5fc7842aff36bd5506af1d413a02e829920fab72e7e44

SHA512
7ea3747779213df50e3e0b55eae0abb20eeebe20ec8ceb630f8aa93e637889cda7f313c683900748c69e2ee0b66117504fbeee5dbf1ee8e71f096b79b5fa6497

Download Submit
\Users\Admin\AppData\Local\Temp\is-7RBJR.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-7RBJR.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-904S2.tmp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp

Filesize
660KB

MD5
aa1e9eec51c34d68b3fae2caf4bea3f2

SHA1
ccd2381cff17acbb0adc0c6f409d6df8346c3803

SHA256
2575430608f57e268eb5fc7842aff36bd5506af1d413a02e829920fab72e7e44

SHA512
7ea3747779213df50e3e0b55eae0abb20eeebe20ec8ceb630f8aa93e637889cda7f313c683900748c69e2ee0b66117504fbeee5dbf1ee8e71f096b79b5fa6497

Download Submit
memory/1484-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1484-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1484-62-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1484-65-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing