ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6

General

Target

ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
Size

153KB
MD5

88034087b4e9678846bc64b34128f020
SHA1

935ee25e1d746c891277fbaf4e6f3cbbedb28d2e
SHA256

ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6
SHA512

43e055f251d39915836828c7c3f36efbe1dfa4eb62ae5d993dee5377dfbbaf826278972960d630609bf333147a229d12e5321df792d1ba67a1e1663572dc70c9
SSDEEP

3072:PQHbkEVizHGn9HV6HutTBfAUOjLx6CidbkoFvFtyySyUnXgsQG:PQHbkEVizHGn9HAHutTB7O04olT/SyUH

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe

Loads dropped DLL 2 IoCs

pid	Process
1648	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1648	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	35.205.61.67

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1648	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
1952	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1952	1648	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe	27
PID 1648 wrote to memory of 1952	1648	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe	27
PID 1648 wrote to memory of 1952	1648	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe	27
PID 1648 wrote to memory of 1952	1648	ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe	27

C:\Users\Admin\AppData\Local\Temp\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
"C:\Users\Admin\AppData\Local\Temp\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\7116750\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
  "C:\Users\Admin\AppData\Local\Temp\7116750\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7116750\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe

Filesize
35.0MB

MD5
27dc871f519cd37567bb4f0e666adcf2

SHA1
479d913c90db52a54739bd11c208626fe9f652cc

SHA256
e129b42a3e8bf5844d7d38b9527af8e7a7cf13eb7b0ee90a265b1bd2329926e2

SHA512
ae39e144c296b7c2781694574af68aeac4e638323b51ba941176956764b037403986d9cdf10fe4c54a7ead912811a245f7725713509c2bc96250c18bf36c8dc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7116750\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe

Filesize
35.0MB

MD5
27dc871f519cd37567bb4f0e666adcf2

SHA1
479d913c90db52a54739bd11c208626fe9f652cc

SHA256
e129b42a3e8bf5844d7d38b9527af8e7a7cf13eb7b0ee90a265b1bd2329926e2

SHA512
ae39e144c296b7c2781694574af68aeac4e638323b51ba941176956764b037403986d9cdf10fe4c54a7ead912811a245f7725713509c2bc96250c18bf36c8dc9

Download Submit
\Users\Admin\AppData\Local\Temp\7116750\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe

Filesize
35.0MB

MD5
27dc871f519cd37567bb4f0e666adcf2

SHA1
479d913c90db52a54739bd11c208626fe9f652cc

SHA256
e129b42a3e8bf5844d7d38b9527af8e7a7cf13eb7b0ee90a265b1bd2329926e2

SHA512
ae39e144c296b7c2781694574af68aeac4e638323b51ba941176956764b037403986d9cdf10fe4c54a7ead912811a245f7725713509c2bc96250c18bf36c8dc9

Download Submit
\Users\Admin\AppData\Local\Temp\7116750\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe

Filesize
35.0MB

MD5
27dc871f519cd37567bb4f0e666adcf2

SHA1
479d913c90db52a54739bd11c208626fe9f652cc

SHA256
e129b42a3e8bf5844d7d38b9527af8e7a7cf13eb7b0ee90a265b1bd2329926e2

SHA512
ae39e144c296b7c2781694574af68aeac4e638323b51ba941176956764b037403986d9cdf10fe4c54a7ead912811a245f7725713509c2bc96250c18bf36c8dc9

Download Submit
memory/1648-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing