9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346

General

Target

9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe
Size

21KB
MD5

b5f13f1f48418c4543dafcdffa80bfd8
SHA1

970d7158bbd85ac3dc19bb227eb57fabb774532a
SHA256

9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346
SHA512

6bf352e2484a256a0d0d2f25c4be68798aafa9ac321a5c22dd0ee171f8382c18e5c593fe305e519dcf52221d28f95e20d5d8e147ff6a880785ab425d91d43d6d
SSDEEP

384:AjH2HJQdV0PyCVcCm23Y54RbwYbUhPbtET/+u:IWpQauhSbUhY//

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1540	opeA323.exe
1648	opeA8EE.exe

Loads dropped DLL 4 IoCs

pid	Process
1668	9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe
1668	9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe
1668	9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe
1668	9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1540	opeA323.exe
1648	opeA8EE.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1540	1668	9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe	27
PID 1668 wrote to memory of 1540	1668	9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe	27
PID 1668 wrote to memory of 1540	1668	9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe	27
PID 1668 wrote to memory of 1540	1668	9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe	27
PID 1668 wrote to memory of 1648	1668	9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe	28
PID 1668 wrote to memory of 1648	1668	9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe	28
PID 1668 wrote to memory of 1648	1668	9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe	28
PID 1668 wrote to memory of 1648	1668	9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe	28

C:\Users\Admin\AppData\Local\Temp\9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe
"C:\Users\Admin\AppData\Local\Temp\9acafa6bfc13f44ed33be6f04660c90d40b112096f0c47997d93b2397e5f0346.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\opeA323.exe
  "C:\Users\Admin\AppData\Local\Temp\opeA323.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1540
- C:\Users\Admin\AppData\Local\Temp\opeA8EE.exe
  "C:\Users\Admin\AppData\Local\Temp\opeA8EE.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\opeA323.exe

Filesize
16KB

MD5
7d6cc562c602703391ba017124b0c748

SHA1
8ab1c545892c490a22b987a14cba78763fd1493f

SHA256
b51a5d3ad9a37550c72aa6a96c8169917928475c5f457dd383f987cbc00feaf1

SHA512
48889caf2ecbef371e797b2dc25bf8d31ab9e96fd125240b5954b3d33b8c4a5ef32c38bc133d5a1dcedcc9c46fa8118aef59f9c08060227a5056515a26c675ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\opeA8EE.exe

Filesize
16KB

MD5
ff927ce0fb3de17763129347a10b2e9f

SHA1
9da4a24dadf6598c4069870cc92e23bc4cabacd1

SHA256
8287eaa6d171aff0c3b6f7c786c8370e1e8897658e2fadc692d31ef798dde3e7

SHA512
6bb771bf56b4719f00530ef49a4b1475c75d884646b38afd95c69ec870b119dd2832b92770d0e775d4bac878a3040818a57e06ce72794289500f921adae346fc

Download Submit
\Users\Admin\AppData\Local\Temp\opeA323.exe

Filesize
16KB

MD5
7d6cc562c602703391ba017124b0c748

SHA1
8ab1c545892c490a22b987a14cba78763fd1493f

SHA256
b51a5d3ad9a37550c72aa6a96c8169917928475c5f457dd383f987cbc00feaf1

SHA512
48889caf2ecbef371e797b2dc25bf8d31ab9e96fd125240b5954b3d33b8c4a5ef32c38bc133d5a1dcedcc9c46fa8118aef59f9c08060227a5056515a26c675ce

Download Submit
\Users\Admin\AppData\Local\Temp\opeA323.exe

Filesize
16KB

MD5
7d6cc562c602703391ba017124b0c748

SHA1
8ab1c545892c490a22b987a14cba78763fd1493f

SHA256
b51a5d3ad9a37550c72aa6a96c8169917928475c5f457dd383f987cbc00feaf1

SHA512
48889caf2ecbef371e797b2dc25bf8d31ab9e96fd125240b5954b3d33b8c4a5ef32c38bc133d5a1dcedcc9c46fa8118aef59f9c08060227a5056515a26c675ce

Download Submit
\Users\Admin\AppData\Local\Temp\opeA8EE.exe

Filesize
16KB

MD5
ff927ce0fb3de17763129347a10b2e9f

SHA1
9da4a24dadf6598c4069870cc92e23bc4cabacd1

SHA256
8287eaa6d171aff0c3b6f7c786c8370e1e8897658e2fadc692d31ef798dde3e7

SHA512
6bb771bf56b4719f00530ef49a4b1475c75d884646b38afd95c69ec870b119dd2832b92770d0e775d4bac878a3040818a57e06ce72794289500f921adae346fc

Download Submit
\Users\Admin\AppData\Local\Temp\opeA8EE.exe

Filesize
16KB

MD5
ff927ce0fb3de17763129347a10b2e9f

SHA1
9da4a24dadf6598c4069870cc92e23bc4cabacd1

SHA256
8287eaa6d171aff0c3b6f7c786c8370e1e8897658e2fadc692d31ef798dde3e7

SHA512
6bb771bf56b4719f00530ef49a4b1475c75d884646b38afd95c69ec870b119dd2832b92770d0e775d4bac878a3040818a57e06ce72794289500f921adae346fc

Download Submit
memory/1668-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1668-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1668-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing