1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2023, 14:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be.exe
Size 437KB
Sample230307-saa6paae45
SHA256 1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be
MD5 8594de05d204f0e762c151d92fc4acad
SHA1 fe6e938b126501d02f335984417186117bf9299d
SHA512 c3166a294904eb1a6d20ef283252d96344cacaddb6b6cddc80d671fb95f8165112597fc6d628ed6193a8ec61a3995f92afbe37c372fd6668768d69e8c2e1db03
SSDEEP 12288:2CycsYglaQRM4+dR2FNvnPmK4+xkbTZO4LniP:27laQRi0Hec0fniP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4936	1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Subjektivisme.lnk	1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sourceless\Pachyglossia186\Nedbren.Oct	1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be.exe
"C:\Users\Admin\AppData\Local\Temp\1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nse85F0.tmp\System.dll
Size 11KB
SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
MD5 960a5c48e25cf2bca332e74e11d825c9
SHA1 da35c6816ace5daf4c6c1d57b93b09a82ecdc876
SHA512 cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
SSDEEP 192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
MD5 SHA1 SHA512 SSDEEP

Submit Download