480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/02/2023, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe
Size

19.3MB
MD5

4752e1d0ba5797a9c9f7bde631b48dcd
SHA1

835bc15cf32df9526c8d0fbfbe05ca1f6c386d1a
SHA256

480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6
SHA512

6147c874e5b9ec4326ba70c8fa74e9cfbafab1880f2698e7ab55c9cd051589e290865b1fd82bb9b001a388fc05c6bf352acfbed0206228350c5fdcaaf498245b
SSDEEP

393216:y5gfMnIdz+hfFKg28MqYpUedvlXNOyGVOtZZBXmVuy5NGBDga47q2rEcJdNJh5l9:y5gfMnIMhfd28Mq8Ue1UqZBXmVJNPB7X

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
768	is-IQGTI.tmp

Loads dropped DLL 3 IoCs

pid	Process
1728	480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe
768	is-IQGTI.tmp
768	is-IQGTI.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 768	1728	480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe	28
PID 1728 wrote to memory of 768	1728	480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe	28
PID 1728 wrote to memory of 768	1728	480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe	28
PID 1728 wrote to memory of 768	1728	480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe	28
PID 1728 wrote to memory of 768	1728	480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe	28
PID 1728 wrote to memory of 768	1728	480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe	28
PID 1728 wrote to memory of 768	1728	480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe	28

C:\Users\Admin\AppData\Local\Temp\480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe
"C:\Users\Admin\AppData\Local\Temp\480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\is-B0NGM.tmp\is-IQGTI.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-B0NGM.tmp\is-IQGTI.tmp" /SL4 $60126 "C:\Users\Admin\AppData\Local\Temp\480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe" 19994724 51200
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-B0NGM.tmp\is-IQGTI.tmp

Filesize
659KB

MD5
8d945b4b32cdbdae0b9e320e6870607f

SHA1
bc109a8a04450c4833449d56b5ad77d1e37fa063

SHA256
70a88b34f9a87419c8df27f097262e1bea0e7db7a8c27aa2376e311dc65de1b6

SHA512
7d59cbc9690c951f9e96e1af257f334affc38559f4d4a77ee4703ebd5a02a4424afa8fb1447775f5a02ab60ba3f49e84906bb8e2b3d44aabdfbdfb8938f0ef29

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-B0NGM.tmp\is-IQGTI.tmp

Filesize
659KB

MD5
8d945b4b32cdbdae0b9e320e6870607f

SHA1
bc109a8a04450c4833449d56b5ad77d1e37fa063

SHA256
70a88b34f9a87419c8df27f097262e1bea0e7db7a8c27aa2376e311dc65de1b6

SHA512
7d59cbc9690c951f9e96e1af257f334affc38559f4d4a77ee4703ebd5a02a4424afa8fb1447775f5a02ab60ba3f49e84906bb8e2b3d44aabdfbdfb8938f0ef29

Download Submit
\Users\Admin\AppData\Local\Temp\is-5PFFD.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-5PFFD.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-B0NGM.tmp\is-IQGTI.tmp

Filesize
659KB

MD5
8d945b4b32cdbdae0b9e320e6870607f

SHA1
bc109a8a04450c4833449d56b5ad77d1e37fa063

SHA256
70a88b34f9a87419c8df27f097262e1bea0e7db7a8c27aa2376e311dc65de1b6

SHA512
7d59cbc9690c951f9e96e1af257f334affc38559f4d4a77ee4703ebd5a02a4424afa8fb1447775f5a02ab60ba3f49e84906bb8e2b3d44aabdfbdfb8938f0ef29

Download Submit
memory/1728-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1728-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1728-64-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download