fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001

General

Target

fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001.exe
Size

2.6MB
MD5

46a0556d72c16f96a9d7a381169a7786
SHA1

8ad661cccac2b3f1adaa0504d81b7903b46c94c5
SHA256

fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001
SHA512

501f72dd61562fcd1c02cfbed3c296aebfe22c6f6ec2923a0d02740af325b8083a25d46e8126ffa376ff04ac24c7389bc490f2477117354203eeb3034bbab3f3
SSDEEP

49152:/6d+KkPZK1mPg66jSw6e8rmt2/PH9R91vEOIfk5promuwocsR7HJiKHLJIo9mWf:CdkM1s6uw6rznV1ws5ZGh97HJiKH1F

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1072	is-63KI0.tmp

Loads dropped DLL 4 IoCs

pid	Process
856	fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001.exe
1072	is-63KI0.tmp
1072	is-63KI0.tmp
1072	is-63KI0.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1072	856	fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001.exe	27
PID 856 wrote to memory of 1072	856	fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001.exe	27
PID 856 wrote to memory of 1072	856	fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001.exe	27
PID 856 wrote to memory of 1072	856	fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001.exe	27
PID 856 wrote to memory of 1072	856	fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001.exe	27
PID 856 wrote to memory of 1072	856	fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001.exe	27
PID 856 wrote to memory of 1072	856	fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001.exe	27

C:\Users\Admin\AppData\Local\Temp\fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001.exe
"C:\Users\Admin\AppData\Local\Temp\fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\is-6GISF.tmp\is-63KI0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6GISF.tmp\is-63KI0.tmp" /SL4 $60124 "C:\Users\Admin\AppData\Local\Temp\fb9efdb85349504838172be4636d71dfea4317fb0ddba5e2056d1ca1ad2d9001.exe" 2516912 52224
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-6GISF.tmp\is-63KI0.tmp

Filesize
635KB

MD5
9bedee409be9e51fd694894e67cdb39e

SHA1
804838236ff5b6d285eb9d8548ecbaaf5882e65a

SHA256
544adccc3008713c4bd7c559456a2519db52b058d000b81b45a21b8835204d9f

SHA512
006aa404f2727ed2ad01d843bc7dd12f90b2b55d2379b9584e6d16b39ce3047019b3a7af795313d943b35965205526145dadfd9604bcc6885ad73e065403ac6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6GISF.tmp\is-63KI0.tmp

Filesize
635KB

MD5
9bedee409be9e51fd694894e67cdb39e

SHA1
804838236ff5b6d285eb9d8548ecbaaf5882e65a

SHA256
544adccc3008713c4bd7c559456a2519db52b058d000b81b45a21b8835204d9f

SHA512
006aa404f2727ed2ad01d843bc7dd12f90b2b55d2379b9584e6d16b39ce3047019b3a7af795313d943b35965205526145dadfd9604bcc6885ad73e065403ac6d

Download Submit
\Users\Admin\AppData\Local\Temp\is-6GISF.tmp\is-63KI0.tmp

Filesize
635KB

MD5
9bedee409be9e51fd694894e67cdb39e

SHA1
804838236ff5b6d285eb9d8548ecbaaf5882e65a

SHA256
544adccc3008713c4bd7c559456a2519db52b058d000b81b45a21b8835204d9f

SHA512
006aa404f2727ed2ad01d843bc7dd12f90b2b55d2379b9584e6d16b39ce3047019b3a7af795313d943b35965205526145dadfd9604bcc6885ad73e065403ac6d

Download Submit
\Users\Admin\AppData\Local\Temp\is-QRBPL.tmp\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
\Users\Admin\AppData\Local\Temp\is-QRBPL.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-QRBPL.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/856-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/856-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/856-65-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing