2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc.exe
Size

239KB
MD5

0acb5bcb968b08f9fa0275337eaf9d81
SHA1

9ff40194659288c71ee7ff01435eac29d5d55004
SHA256

2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc
SHA512

a6c9ee59f120f5400ea08726337ed52d982184d71809f12255f44643fb6170e996a0bd89b5465b6498854978e0acab09e7cb7d6b912bcd1396e848392b1e986a
SSDEEP

6144:QBn1gQ5lYu+gRaCuvlFMC5oTlyEwP5Od6mcELn3Wm:ggQ4DgRaxL5oJmP5O3jmm

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

utmeaaxkt.exe

pid process

2040 utmeaaxkt.exe
Loads dropped DLL 1 IoCs

Processes:

2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc.exe

pid process

1340 2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2040	utmeaaxkt.exe

pid	process
1340	2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc.exe

description	pid	process	target process
PID 1340 wrote to memory of 2040	1340	2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc.exe	utmeaaxkt.exe
PID 1340 wrote to memory of 2040	1340	2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc.exe	utmeaaxkt.exe
PID 1340 wrote to memory of 2040	1340	2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc.exe	utmeaaxkt.exe
PID 1340 wrote to memory of 2040	1340	2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc.exe	utmeaaxkt.exe

C:\Users\Admin\AppData\Local\Temp\2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc.exe
"C:\Users\Admin\AppData\Local\Temp\2b11d3a570fd45fda3e8c062f447e09dbabcfafee5e89f4258c0ac7c6e294fdc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340

C:\Users\Admin\AppData\Local\Temp\utmeaaxkt.exe
"C:\Users\Admin\AppData\Local\Temp\utmeaaxkt.exe" C:\Users\Admin\AppData\Local\Temp\pmrftq.yd
2⤵
- Executes dropped EXE
PID:2040

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\utmeaaxkt.exe
Filesize
46KB

MD5
8627b859df0f7adfe76b545c5b5ebf1f

SHA1
1d1ee3ad3452b25ca5e467bc5317d2e61819e39f

SHA256
6ae3660b761846df15f7cc42dd6ea7fd43039f55685ead53b820fd07b5589295

SHA512
c59c97a8c511f6913f099b890fea3cb1c1718733f3182887c5bc796f16dcfd3916b42de802f293a938e86b1ddc56f482d8d3dff3adbcc12fcbc6050a363f05c7

Download Submit
\Users\Admin\AppData\Local\Temp\utmeaaxkt.exe
Filesize
46KB

MD5
8627b859df0f7adfe76b545c5b5ebf1f

SHA1
1d1ee3ad3452b25ca5e467bc5317d2e61819e39f

SHA256
6ae3660b761846df15f7cc42dd6ea7fd43039f55685ead53b820fd07b5589295

SHA512
c59c97a8c511f6913f099b890fea3cb1c1718733f3182887c5bc796f16dcfd3916b42de802f293a938e86b1ddc56f482d8d3dff3adbcc12fcbc6050a363f05c7

Download Submit
memory/1340-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/2040-56-0x0000000000000000-mapping.dmp

Download