d9e198ed8bd2be27c6b5dd9d5f7d8f90332d3c3b583b7b507ac1643d28bac700

Analysis

max time kernel
34s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 06:05

Target

ESETMS ACTIVACION BY THE CHIKENLITLE99/MiNODLogin.v4.0.1.55/ESET Antivirus License Finder (MiNODLogin) 4.0.1.55.exe
Size

928KB
MD5

2eec805e4b485a5d8d9d8f0ba1e9978b
SHA1

e04b56dac61a105c198246d1d5bc0f0f1fa29efe
SHA256

18807a858647a67c9ae44dc8f62545309d41674123203ce2bfd08b94d37431a6
SHA512

52cf9fe45d7822754e02c1ed70173dd86e6b835474e5a7385c33d5356a2d9d142bf4fcc51aca03524bf8fe1c445262a979bdbd8c4ad5d1d3b7557ef86d128bd4
SSDEEP

24576:1GiPH//0wjSkOAw6CBLnuUXRY4o/kw8RTy0h8jzX:MsfsoXYZBLu83o/h8Rtg

Score

7^/10

Loads dropped DLL 3 IoCs

pid	Process
900	ESET Antivirus License Finder (MiNODLogin) 4.0.1.55.exe
900	ESET Antivirus License Finder (MiNODLogin) 4.0.1.55.exe
900	ESET Antivirus License Finder (MiNODLogin) 4.0.1.55.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ESETMS ACTIVACION BY THE CHIKENLITLE99\MiNODLogin.v4.0.1.55\ESET Antivirus License Finder (MiNODLogin) 4.0.1.55.exe
"C:\Users\Admin\AppData\Local\Temp\ESETMS ACTIVACION BY THE CHIKENLITLE99\MiNODLogin.v4.0.1.55\ESET Antivirus License Finder (MiNODLogin) 4.0.1.55.exe"
1⤵
- Loads dropped DLL
PID:900

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsy46A3.tmp\LangDLL.dll

Filesize
5KB

MD5
a1cd3f159ef78d9ace162f067b544fd9

SHA1
72671fdf4bfeeb99b392685bf01081b4a0b3ae66

SHA256
47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6

SHA512
ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362

Download Submit
\Users\Admin\AppData\Local\Temp\nsy46A3.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nsy46A3.tmp\nsDialogs.dll

Filesize
9KB

MD5
4ccc4a742d4423f2f0ed744fd9c81f63

SHA1
704f00a1acc327fd879cf75fc90d0b8f927c36bc

SHA256
416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

SHA512
790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

Download Submit
memory/900-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download