63ec01839919b7f832954e17b9259a74fe90e0217f178dbd5f7661454af4c91f

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/01/2023, 13:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b561c766f16984cad7bd9303131d69da7cae866a.exe
Size

445KB
MD5

7f86f5c4f81ec48b4b6bfc92b29ec751
SHA1

b561c766f16984cad7bd9303131d69da7cae866a
SHA256

63ec01839919b7f832954e17b9259a74fe90e0217f178dbd5f7661454af4c91f
SHA512

d040eb130075902d49536dca8b1abe4bc49ff6421884a793da73f956bf614806949b89ce602168bdc5a55af111871ee4120654f136914e4e63d2170557806cb3
SSDEEP

12288:3Y7shrtvJ4uNMIL/TJF/DaYVgl5NVx1fFHD02SJZ:3Yu1KA1I/FXngPZ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
896	tbelmde.exe
1492	tbelmde.exe

Loads dropped DLL 5 IoCs

pid	Process
1476	b561c766f16984cad7bd9303131d69da7cae866a.exe
896	tbelmde.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 896 set thread context of 1492	896	tbelmde.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	1492	WerFault.exe	29

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
896	tbelmde.exe
896	tbelmde.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 896	1476	b561c766f16984cad7bd9303131d69da7cae866a.exe	28
PID 1476 wrote to memory of 896	1476	b561c766f16984cad7bd9303131d69da7cae866a.exe	28
PID 1476 wrote to memory of 896	1476	b561c766f16984cad7bd9303131d69da7cae866a.exe	28
PID 1476 wrote to memory of 896	1476	b561c766f16984cad7bd9303131d69da7cae866a.exe	28
PID 896 wrote to memory of 1492	896	tbelmde.exe	29
PID 896 wrote to memory of 1492	896	tbelmde.exe	29
PID 896 wrote to memory of 1492	896	tbelmde.exe	29
PID 896 wrote to memory of 1492	896	tbelmde.exe	29
PID 896 wrote to memory of 1492	896	tbelmde.exe	29
PID 1492 wrote to memory of 1736	1492	tbelmde.exe	30
PID 1492 wrote to memory of 1736	1492	tbelmde.exe	30
PID 1492 wrote to memory of 1736	1492	tbelmde.exe	30
PID 1492 wrote to memory of 1736	1492	tbelmde.exe	30

C:\Users\Admin\AppData\Local\Temp\b561c766f16984cad7bd9303131d69da7cae866a.exe
"C:\Users\Admin\AppData\Local\Temp\b561c766f16984cad7bd9303131d69da7cae866a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\tbelmde.exe
  "C:\Users\Admin\AppData\Local\Temp\tbelmde.exe" C:\Users\Admin\AppData\Local\Temp\lxirk.jhb
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Users\Admin\AppData\Local\Temp\tbelmde.exe
    "C:\Users\Admin\AppData\Local\Temp\tbelmde.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 36
      4⤵
      Loads dropped DLL
      Program crash
      PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\blqttgnqqaq.qo

Filesize
205KB

MD5
7e6daa507120f5d554a44c601bbfba58

SHA1
4018d5a2de62d2013a6c898828f8a74e814d5c1d

SHA256
ca29d66f49018a38a180092513e189a53577092219ff4c8d119b30055913cbe1

SHA512
896aaa9adaa33227e0abbac98aa43f4ae2c66d8efc41ba50d452ceea170508f6a049af6621e452eec3b215895cdb0e719c3c9afd34e257b77ff133e591aab1d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lxirk.jhb

Filesize
5KB

MD5
7611d59c10c085fe2b6f33cb8bc797b9

SHA1
8e6a6c47f32c48d1892b664b734c324cd70e0fb0

SHA256
1391af011ebe5d6d3bbfd08ad339779d49b65f28260aef59bb4fb490b77c03ab

SHA512
2f59ffdc86c719e780b7f07102dd1f3ee53d20f9f1f5464c0ac94495a8da25ddefe94e97499ab7c0da1a5d6bcd71d549da2bfef3d4d85e5d132c6a38534dcf65

Download Submit
C:\Users\Admin\AppData\Local\Temp\tbelmde.exe

Filesize
12KB

MD5
2a653d1ff961008fca702200878c9bf1

SHA1
676dbca890fedf5e3fec6e8df688dbf0ef8436f2

SHA256
e1fc47c2cbfda644718c2e519fcc103b8cb43b11b878183648be966082485bba

SHA512
15b136b5561d3922113855a9caebe7b4b0813a4b7b28cc7cababa1f546bcb37217155273a7aa4d8ee0e4b54cf480383c4cd002dddf8f416de2e2a4b74ac697d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tbelmde.exe

Filesize
12KB

MD5
2a653d1ff961008fca702200878c9bf1

SHA1
676dbca890fedf5e3fec6e8df688dbf0ef8436f2

SHA256
e1fc47c2cbfda644718c2e519fcc103b8cb43b11b878183648be966082485bba

SHA512
15b136b5561d3922113855a9caebe7b4b0813a4b7b28cc7cababa1f546bcb37217155273a7aa4d8ee0e4b54cf480383c4cd002dddf8f416de2e2a4b74ac697d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tbelmde.exe

Filesize
12KB

MD5
2a653d1ff961008fca702200878c9bf1

SHA1
676dbca890fedf5e3fec6e8df688dbf0ef8436f2

SHA256
e1fc47c2cbfda644718c2e519fcc103b8cb43b11b878183648be966082485bba

SHA512
15b136b5561d3922113855a9caebe7b4b0813a4b7b28cc7cababa1f546bcb37217155273a7aa4d8ee0e4b54cf480383c4cd002dddf8f416de2e2a4b74ac697d8

Download Submit
\Users\Admin\AppData\Local\Temp\tbelmde.exe

Filesize
12KB

MD5
2a653d1ff961008fca702200878c9bf1

SHA1
676dbca890fedf5e3fec6e8df688dbf0ef8436f2

SHA256
e1fc47c2cbfda644718c2e519fcc103b8cb43b11b878183648be966082485bba

SHA512
15b136b5561d3922113855a9caebe7b4b0813a4b7b28cc7cababa1f546bcb37217155273a7aa4d8ee0e4b54cf480383c4cd002dddf8f416de2e2a4b74ac697d8

Download Submit
\Users\Admin\AppData\Local\Temp\tbelmde.exe

Filesize
12KB

MD5
2a653d1ff961008fca702200878c9bf1

SHA1
676dbca890fedf5e3fec6e8df688dbf0ef8436f2

SHA256
e1fc47c2cbfda644718c2e519fcc103b8cb43b11b878183648be966082485bba

SHA512
15b136b5561d3922113855a9caebe7b4b0813a4b7b28cc7cababa1f546bcb37217155273a7aa4d8ee0e4b54cf480383c4cd002dddf8f416de2e2a4b74ac697d8

Download Submit
\Users\Admin\AppData\Local\Temp\tbelmde.exe

Filesize
12KB

MD5
2a653d1ff961008fca702200878c9bf1

SHA1
676dbca890fedf5e3fec6e8df688dbf0ef8436f2

SHA256
e1fc47c2cbfda644718c2e519fcc103b8cb43b11b878183648be966082485bba

SHA512
15b136b5561d3922113855a9caebe7b4b0813a4b7b28cc7cababa1f546bcb37217155273a7aa4d8ee0e4b54cf480383c4cd002dddf8f416de2e2a4b74ac697d8

Download Submit
\Users\Admin\AppData\Local\Temp\tbelmde.exe

Filesize
12KB

MD5
2a653d1ff961008fca702200878c9bf1

SHA1
676dbca890fedf5e3fec6e8df688dbf0ef8436f2

SHA256
e1fc47c2cbfda644718c2e519fcc103b8cb43b11b878183648be966082485bba

SHA512
15b136b5561d3922113855a9caebe7b4b0813a4b7b28cc7cababa1f546bcb37217155273a7aa4d8ee0e4b54cf480383c4cd002dddf8f416de2e2a4b74ac697d8

Download Submit
\Users\Admin\AppData\Local\Temp\tbelmde.exe

Filesize
12KB

MD5
2a653d1ff961008fca702200878c9bf1

SHA1
676dbca890fedf5e3fec6e8df688dbf0ef8436f2

SHA256
e1fc47c2cbfda644718c2e519fcc103b8cb43b11b878183648be966082485bba

SHA512
15b136b5561d3922113855a9caebe7b4b0813a4b7b28cc7cababa1f546bcb37217155273a7aa4d8ee0e4b54cf480383c4cd002dddf8f416de2e2a4b74ac697d8

Download Submit
memory/1476-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download