9a18fdec476ae659ae5d79a06c9fdf7f0a36e685430a9bc2b59418604bf785ad

Analysis

max time kernel
169s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2023, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394.exe
Size 1.3MB
Sample230331-v3jpmsdd4t
SHA256 11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394
MD5 df134a54ae5dca7963e49d97dd104660
SHA1 9bddcce91756469051f2385ef36ba8171d99686d
SHA512 9046be2d1af55141001c8f35b06af2607a329e3b4d97253972362ef4ffb61106be3bf6701cbcc36f1a39028c9f17d19b414f6ee63bc34e4622a5833752a17914
SSDEEP 24576:fsspRa70Hm5QQF0fTOOqs60utA+islfs/DHEj3TBi0mhwLlz2Ya60xchhH2yP1DF:f7W707QEpq3u+PkDHEj3TBi0mhwLlz2q
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

ransomware spyware stealer

Malware Config

Signatures

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ExportRepair.png => C:\Users\Admin\Pictures\ExportRepair.png.dark_power	11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394.exe
File renamed	C:\Users\Admin\Pictures\DebugClose.tif => C:\Users\Admin\Pictures\DebugClose.tif.dark_power	11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 212	1636	11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394.exe	80
PID 1636 wrote to memory of 212	1636	11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394.exe	80

C:\Users\Admin\AppData\Local\Temp\11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394.exe
"C:\Users\Admin\AppData\Local\Temp\11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394.exe"
1⤵
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

readme.pdf

Path C:\Users\Admin\Favorites\readme.pdf
Size 529KB
SHA256 c14c8e924987138d0ec9c1a99dd5ac728ce102aa5c6b13829ec8d21ddb243f28
MD5 e7a1ded35fa8603ad2d8ea413ed70822
SHA1 8e51bc110584663dc297af70b76173b9a05bb39e
SHA512 e1122f6bf05dc22ed840ace88a6c3823db98fb05362e5cac3202bd49951593e562d57e3fe7cf05a1dfcf6b34c2e594f999287fb8ed973a3b870cce2a4e9955b4
SSDEEP 12288:3MRBLmeSkccm9hM+qF+974DJTc1IYyF/dy:cRZmeLm92xs9e0ytg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1636-133-0x00007FF792200000-0x00007FF79232F000-memory.dmp

Download

memory/1636-134-0x00007FF792200000-0x00007FF79232F000-memory.dmp

Download

memory/1636-135-0x00007FF792200000-0x00007FF79232F000-memory.dmp

Download

memory/1636-207-0x00007FF792200000-0x00007FF79232F000-memory.dmp

Download

memory/1636-247-0x00007FF792200000-0x00007FF79232F000-memory.dmp

Download

memory/1636-310-0x00007FF792200000-0x00007FF79232F000-memory.dmp

Download

memory/1636-367-0x00007FF792200000-0x00007FF79232F000-memory.dmp

Download

memory/1636-392-0x00007FF792200000-0x00007FF79232F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads