5f5b85076aed7e8f4783671b077a759eb4cdd869a163b9f6d451b8efc8106efb

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/03/2023, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5f5b85076aed7e8f4783671b077a759eb4cdd869a163b9f6d451b8efc8106efb.exe
Size

1.1MB
MD5

4fd2443bd5213b2be27bfba63ceeed5a
SHA1

b82ae5efeb248b35b556e0ddb4b1c3436eacf842
SHA256

5f5b85076aed7e8f4783671b077a759eb4cdd869a163b9f6d451b8efc8106efb
SHA512

42ff8591f4472f4d1cc64150b16024bab163045fa47fa6bbe3a101d9b7053bee11e68d50cf685c1594d98f759eeff1fdd307281db72c0ae03c683f30e3707cc7
SSDEEP

12288:goFzSz5nKfyIed7ni5XZFsZbMhcId3fEe16M9NQv3c5V8urgnfhmYUuaVXvc7+3q:xFuVIfS4hcIF4gN8BoYU/q+3yHpz

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
576	DomaIQ10.exe

Loads dropped DLL 1 IoCs

pid	Process
928	5f5b85076aed7e8f4783671b077a759eb4cdd869a163b9f6d451b8efc8106efb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
576	DomaIQ10.exe
576	DomaIQ10.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 576	928	5f5b85076aed7e8f4783671b077a759eb4cdd869a163b9f6d451b8efc8106efb.exe	27
PID 928 wrote to memory of 576	928	5f5b85076aed7e8f4783671b077a759eb4cdd869a163b9f6d451b8efc8106efb.exe	27
PID 928 wrote to memory of 576	928	5f5b85076aed7e8f4783671b077a759eb4cdd869a163b9f6d451b8efc8106efb.exe	27
PID 928 wrote to memory of 576	928	5f5b85076aed7e8f4783671b077a759eb4cdd869a163b9f6d451b8efc8106efb.exe	27

C:\Users\Admin\AppData\Local\Temp\5f5b85076aed7e8f4783671b077a759eb4cdd869a163b9f6d451b8efc8106efb.exe
"C:\Users\Admin\AppData\Local\Temp\5f5b85076aed7e8f4783671b077a759eb4cdd869a163b9f6d451b8efc8106efb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:928
- C:\Users\Admin\AppData\Local\Temp\DIQ\FlashPlayer_151\DomaIQ10.exe
  C:\Users\Admin\AppData\Local\Temp\DIQ\FlashPlayer_151\DomaIQ10.exe /path="C:\Users\Admin\AppData\Local\Temp\5f5b85076aed7e8f4783671b077a759eb4cdd869a163b9f6d451b8efc8106efb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DIQ\FlashPlayer_151\DomaIQ10.exe

Filesize
339KB

MD5
cfea6194089142f9aef9bf40965a4ab9

SHA1
52a8aefaf42bc3bda31fecf0f5aa9c2246407f29

SHA256
e87d977191ac59568e04cfaa72d0cd5c0e0b90287111c7c3f2035c493cb7c116

SHA512
d657d7a20c8f37eb8202e56b42c7a8d80de77f5c903d46d7180141597c9464e1edf74757c1a47e4479bd10e4f446de7f68382d27beda9b24babc92e879013f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\DIQ\FlashPlayer_151\DomaIQ10.exe

Filesize
339KB

MD5
cfea6194089142f9aef9bf40965a4ab9

SHA1
52a8aefaf42bc3bda31fecf0f5aa9c2246407f29

SHA256
e87d977191ac59568e04cfaa72d0cd5c0e0b90287111c7c3f2035c493cb7c116

SHA512
d657d7a20c8f37eb8202e56b42c7a8d80de77f5c903d46d7180141597c9464e1edf74757c1a47e4479bd10e4f446de7f68382d27beda9b24babc92e879013f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\DIQ\FlashPlayer_151\config.dll

Filesize
36B

MD5
577f5191f2032686d02d9325e15a4269

SHA1
471dca0ebbad425f10f350e17035a18187babe67

SHA256
e79b2681a9423ea4aad90c1293aee92e9cf030177129063068e47bc7fbe366b7

SHA512
2283dbe688cd8f38f04dccd34a975c25ce29b031d072556b198dedf2675e7bb2062afd2e57b03194814051241b511f8ed80746509507041f080ce7815e922a4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\DIQ\FlashPlayer_151\routes.dll

Filesize
257B

MD5
8fc132d017671cb9f0322ef97411aed7

SHA1
ec7587f1ce58736442912f1152fcc76c735eb26c

SHA256
a5d0ce7bd7d4c43cb49c2a76ceef62fe78733c22ad6132da73a871f29aeb5280

SHA512
2d5145b253ca05f3b28bb35dac53611cb7513b0502f01307cd47e592789abe85f68e6c8a312e5b319a34a0e10be6fb60b42cbf0b6084c43a07fdb96196192d37

Download Submit
\Users\Admin\AppData\Local\Temp\DIQ\FlashPlayer_151\DomaIQ10.exe

Filesize
339KB

MD5
cfea6194089142f9aef9bf40965a4ab9

SHA1
52a8aefaf42bc3bda31fecf0f5aa9c2246407f29

SHA256
e87d977191ac59568e04cfaa72d0cd5c0e0b90287111c7c3f2035c493cb7c116

SHA512
d657d7a20c8f37eb8202e56b42c7a8d80de77f5c903d46d7180141597c9464e1edf74757c1a47e4479bd10e4f446de7f68382d27beda9b24babc92e879013f38

Download Submit
memory/576-64-0x00000000000C0000-0x000000000011C000-memory.dmp

Filesize
368KB

Download
memory/576-65-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/576-66-0x0000000001F90000-0x0000000002010000-memory.dmp

Filesize
512KB

Download
memory/576-67-0x0000000001F90000-0x0000000002010000-memory.dmp

Filesize
512KB

Download
memory/576-68-0x0000000001F90000-0x0000000002010000-memory.dmp

Filesize
512KB

Download
memory/576-71-0x0000000001F90000-0x0000000002010000-memory.dmp

Filesize
512KB

Download