a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0

General

Target

a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0.exe
Size

41KB
MD5

ec33976b3011688c413a11e447cc8cc8
SHA1

aafec04e967cd4fac2d51252d56c1d9e3aca950b
SHA256

a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0
SHA512

c5f2b23a7c590d940de67620e38fbe21a4030e8ae4e560601dc0405465832b27b89f34c4ffe02965b7d42fddbd25331ef8b5ef113a4279d2a657c7b3f00895e6
SSDEEP

768:QIBar1ZIZYnfI9opm6AIHIjaI7g9mVmUn2oNE/W5dRV8:pW1ZIZqI9opm6AIHIjzmUXNzd

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1564	sxhost.exe

Deletes itself 1 IoCs

pid	Process
1428	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
892	a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0.exe
892	a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1564	892	a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0.exe	28
PID 892 wrote to memory of 1564	892	a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0.exe	28
PID 892 wrote to memory of 1564	892	a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0.exe	28
PID 892 wrote to memory of 1564	892	a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0.exe	28
PID 892 wrote to memory of 1428	892	a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0.exe	29
PID 892 wrote to memory of 1428	892	a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0.exe	29
PID 892 wrote to memory of 1428	892	a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0.exe	29
PID 892 wrote to memory of 1428	892	a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0.exe	29
PID 1564 wrote to memory of 1772	1564	sxhost.exe	33
PID 1564 wrote to memory of 1772	1564	sxhost.exe	33
PID 1564 wrote to memory of 1772	1564	sxhost.exe	33
PID 1564 wrote to memory of 1772	1564	sxhost.exe	33

C:\Users\Admin\AppData\Local\Temp\a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0.exe
"C:\Users\Admin\AppData\Local\Temp\a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\sxhost.exe
  "C:\Users\Admin\sxhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del C:\Users\Admin\sxhost.exe >> NUL
    3⤵
    PID:1772
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A008FE~1.EXE >> NUL
  2⤵
  - Deletes itself
  PID:1428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\sxhost.exe

Filesize
41KB

MD5
ec33976b3011688c413a11e447cc8cc8

SHA1
aafec04e967cd4fac2d51252d56c1d9e3aca950b

SHA256
a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0

SHA512
c5f2b23a7c590d940de67620e38fbe21a4030e8ae4e560601dc0405465832b27b89f34c4ffe02965b7d42fddbd25331ef8b5ef113a4279d2a657c7b3f00895e6

Download Submit
C:\Users\Admin\sxhost.exe

Filesize
41KB

MD5
ec33976b3011688c413a11e447cc8cc8

SHA1
aafec04e967cd4fac2d51252d56c1d9e3aca950b

SHA256
a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0

SHA512
c5f2b23a7c590d940de67620e38fbe21a4030e8ae4e560601dc0405465832b27b89f34c4ffe02965b7d42fddbd25331ef8b5ef113a4279d2a657c7b3f00895e6

Download Submit
\Users\Admin\sxhost.exe

Filesize
41KB

MD5
ec33976b3011688c413a11e447cc8cc8

SHA1
aafec04e967cd4fac2d51252d56c1d9e3aca950b

SHA256
a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0

SHA512
c5f2b23a7c590d940de67620e38fbe21a4030e8ae4e560601dc0405465832b27b89f34c4ffe02965b7d42fddbd25331ef8b5ef113a4279d2a657c7b3f00895e6

Download Submit
\Users\Admin\sxhost.exe

Filesize
41KB

MD5
ec33976b3011688c413a11e447cc8cc8

SHA1
aafec04e967cd4fac2d51252d56c1d9e3aca950b

SHA256
a008fe4f80ed3aa2fea192c8056b2a9c84f43c1d43c13ac5e569c3ec74c4f0c0

SHA512
c5f2b23a7c590d940de67620e38fbe21a4030e8ae4e560601dc0405465832b27b89f34c4ffe02965b7d42fddbd25331ef8b5ef113a4279d2a657c7b3f00895e6

Download Submit
memory/892-61-0x0000000002780000-0x0000000002795000-memory.dmp

Filesize
84KB

Download
memory/892-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/892-62-0x0000000002780000-0x0000000002795000-memory.dmp

Filesize
84KB

Download
memory/892-65-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/892-55-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1428-64-0x0000000000000000-mapping.dmp

Download
memory/1564-58-0x0000000000000000-mapping.dmp

Download
memory/1564-63-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1564-67-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1772-66-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing