22de0c813bd5ad4cfd8ec3ec73a8b0bad8753ebb09bd0552d804048242225ebc

Analysis

max time kernel
162s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2ef6c7916c9ab2b9f900fad1825789a8.exe
Size 11.6MB
Sample221207-3xatjsbe6x
SHA256 22de0c813bd5ad4cfd8ec3ec73a8b0bad8753ebb09bd0552d804048242225ebc
MD5 2ef6c7916c9ab2b9f900fad1825789a8
SHA1 a670c37dd9f6afa2aaa7f1f91433eb422b3c2197
SHA512 0640557285ff4c877946e7748247a74e2008ad5ff8085d85770490c745f9fd06eb46f79e1d8ae621e28e4256de0ada19069e9915dd007769a7f945196cf5eb9f
SSDEEP 98304:E3IMx1wUOEz/Uc1zm8GSB/cTFnmwvYFqwEYXN:ktx1fLSXTnU
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
708	abd1721a-95f6-4319-aefe-834a11d924ae.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\loader.lnk	2ef6c7916c9ab2b9f900fad1825789a8.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 708	2632	2ef6c7916c9ab2b9f900fad1825789a8.exe	83
PID 2632 wrote to memory of 708	2632	2ef6c7916c9ab2b9f900fad1825789a8.exe	83

C:\Users\Admin\AppData\Local\Temp\2ef6c7916c9ab2b9f900fad1825789a8.exe
"C:\Users\Admin\AppData\Local\Temp\2ef6c7916c9ab2b9f900fad1825789a8.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\abd1721a-95f6-4319-aefe-834a11d924ae.exe
  C:\Users\Admin\AppData\Local\Temp\abd1721a-95f6-4319-aefe-834a11d924ae.exe
  2⤵
  - Executes dropped EXE
  PID:708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

abd1721a-95f6-4319-aefe-834a11d924ae.exe

Path C:\Users\Admin\AppData\Local\Temp\abd1721a-95f6-4319-aefe-834a11d924ae.exe
Size 7.9MB
SHA256 2d98101d3765e5364c9eac578c9379c49b0741307ddf6309f2bb6efa79b3d897
MD5 964a902e6f03241f8b268906cefe2226
SHA1 c10df74209985279f16b47834dc7ee76b7463106
SHA512 313b2fd2e6abfa5df9435a0582e0faaa8412b4920ffa5a5c4d577b9fbea46e6f4f183df58464d7c967f015423b91a9876f54e2811a3e4adc6724dc024504c9a2
SSDEEP 98304:F33Xz00QZzcYErovhMANzOt9ROpMB+evMp/uOZ:ND000wroZdNzOCMB+4k
MD5 SHA1 SHA512 SSDEEP

Submit Download