acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0

General

Target

acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0.exe
Size

812KB
MD5

2eec9b658586abb4c40faf530157c000
SHA1

9bebe68275043c47c0fe14af42f9d2fd2e1a77ac
SHA256

acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0
SHA512

7fe6c6f14d489e17116e5d01f7c9625170a0b0e44d01b84dcd20d7bba0cdc961f34d7eecbb259f59ee8fab7d34c6ce103ba09295c9d4eab9929875e2752fbff9
SSDEEP

24576:TA7wX8YdjYaVizKT33IrbWKHTnv+TtQBgzpSZ084fBZ:0kX8YhYamK0jnCtQQm0tZ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
768	b4ef8fba3a00f26fef80c68d98b68136.exe
668	b4ef8fba3a00f26fef80c68d98b68136.tmp

Loads dropped DLL 3 IoCs

pid	Process
2040	acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0.exe
2040	acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0.exe
768	b4ef8fba3a00f26fef80c68d98b68136.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 768	2040	acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0.exe	28
PID 2040 wrote to memory of 768	2040	acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0.exe	28
PID 2040 wrote to memory of 768	2040	acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0.exe	28
PID 2040 wrote to memory of 768	2040	acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0.exe	28
PID 2040 wrote to memory of 768	2040	acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0.exe	28
PID 2040 wrote to memory of 768	2040	acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0.exe	28
PID 2040 wrote to memory of 768	2040	acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0.exe	28

C:\Users\Admin\AppData\Local\Temp\acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0.exe
"C:\Users\Admin\AppData\Local\Temp\acf2d0a9ead56c673f24d0dc3dab66faa20d14d2726fb8d5b301d01d0347c6d0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\b4ef8fba3a00f26fef80c68d98b68136.exe
  C:\Users\Admin\AppData\Local\Temp\b4ef8fba3a00f26fef80c68d98b68136.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:768
- - C:\Users\Admin\AppData\Local\Temp\is-ICHVR.tmp\b4ef8fba3a00f26fef80c68d98b68136.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-ICHVR.tmp\b4ef8fba3a00f26fef80c68d98b68136.tmp" /SL5="$7011C,705874,56832,C:\Users\Admin\AppData\Local\Temp\b4ef8fba3a00f26fef80c68d98b68136.exe"
    3⤵
    - Executes dropped EXE
    PID:668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b4ef8fba3a00f26fef80c68d98b68136.exe

Filesize
775KB

MD5
9b4a8d057230c02e3aa5e750ef9017f2

SHA1
b34989491fb9ff1ed9d4fb689b4af7b76f7251a2

SHA256
a6f84f34000259de8b38871b367a4eedf17b3eca5103f1822c633658188d2183

SHA512
3992a055b7d3f537f36381d1c2fcf13d2e78d06b4fadc32537e62833a01338bd2b4be8f754d92a1aae755f789b322655b711552a15f522f76dcb771af839b9da

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4ef8fba3a00f26fef80c68d98b68136.exe

Filesize
775KB

MD5
9b4a8d057230c02e3aa5e750ef9017f2

SHA1
b34989491fb9ff1ed9d4fb689b4af7b76f7251a2

SHA256
a6f84f34000259de8b38871b367a4eedf17b3eca5103f1822c633658188d2183

SHA512
3992a055b7d3f537f36381d1c2fcf13d2e78d06b4fadc32537e62833a01338bd2b4be8f754d92a1aae755f789b322655b711552a15f522f76dcb771af839b9da

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ICHVR.tmp\b4ef8fba3a00f26fef80c68d98b68136.tmp

Filesize
44KB

MD5
4c275cff83d25bd055efc3833755fe28

SHA1
6625ab013964c32d6adcfeda1c70723e31d400e0

SHA256
a851065a80f432180a510a37557220ff4054a47e8a5348e2796803c2ec9bef40

SHA512
1d892b4087b28d79814eaae797899d0341e1d538ac87dcc4569488ec03daf3d8b09132a6afdb5547844f06dc9d28b8aee645d70bf341511e6de551620d18ed66

Download Submit
\Users\Admin\AppData\Local\Temp\b4ef8fba3a00f26fef80c68d98b68136.exe

Filesize
775KB

MD5
9b4a8d057230c02e3aa5e750ef9017f2

SHA1
b34989491fb9ff1ed9d4fb689b4af7b76f7251a2

SHA256
a6f84f34000259de8b38871b367a4eedf17b3eca5103f1822c633658188d2183

SHA512
3992a055b7d3f537f36381d1c2fcf13d2e78d06b4fadc32537e62833a01338bd2b4be8f754d92a1aae755f789b322655b711552a15f522f76dcb771af839b9da

Download Submit
\Users\Admin\AppData\Local\Temp\is-ICHVR.tmp\b4ef8fba3a00f26fef80c68d98b68136.tmp

Filesize
44KB

MD5
4c275cff83d25bd055efc3833755fe28

SHA1
6625ab013964c32d6adcfeda1c70723e31d400e0

SHA256
a851065a80f432180a510a37557220ff4054a47e8a5348e2796803c2ec9bef40

SHA512
1d892b4087b28d79814eaae797899d0341e1d538ac87dcc4569488ec03daf3d8b09132a6afdb5547844f06dc9d28b8aee645d70bf341511e6de551620d18ed66

Download Submit
\Users\Admin\AppData\Local\Temp\nsy98E7.tmp\nxs.dll

Filesize
6KB

MD5
8ca09b6200ffa05b54c6672d855beb4a

SHA1
daa16fe49c8b2250e9d2383b861cda51f876de49

SHA256
033e93ad470241c92762924ccfceafb849a525e263e5d4a3dbcfc2e07a8803c3

SHA512
6ab97181ec45430888d8ad3fd411de22423e1c057833e282af085a975198338c95f7ba10b7c69f33298afc88ddd38d01ab010998fd4a8ba8abb8561796bf9f14

Download Submit
memory/768-60-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/768-65-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2040-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing