b0f4ebf345bc6e1f5b6b4349f9b99aa9fc9c7db9f1c448a4ce3963b9caa304e3

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/04/2023, 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WRV_Searcher_Lite.exe
Size

6.3MB
MD5

f52c19c43946126a96dfc7fd3aefe175
SHA1

d4ad6d9d147bc342375ad2b2f009d698596e01ae
SHA256

b0f4ebf345bc6e1f5b6b4349f9b99aa9fc9c7db9f1c448a4ce3963b9caa304e3
SHA512

42a8fef9efd67066950698f2241d3083d72487cfa53f108b127542fcb827b2de668b43a9ef11785c5e53ced00d97e9248c0cb3c7a72f262424243a2fff23a0e7
SSDEEP

98304:NLQI8jG3Eq2zlsg3xZWUqZm56Ui7MPrAE4xeu3lQoeV9Zw1s2tJajg88Ol8Ypl0O:NsUdgZWUl7igTcY3Zwjcjg8LuuzKK

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1808	main.exe

Loads dropped DLL 2 IoCs

pid	Process
928	WRV_Searcher_Lite.exe
1808	main.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 1808	928	WRV_Searcher_Lite.exe	29
PID 928 wrote to memory of 1808	928	WRV_Searcher_Lite.exe	29
PID 928 wrote to memory of 1808	928	WRV_Searcher_Lite.exe	29

C:\Users\Admin\AppData\Local\Temp\WRV_Searcher_Lite.exe
"C:\Users\Admin\AppData\Local\Temp\WRV_Searcher_Lite.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:928
- C:\Users\Admin\AppData\Local\Temp\onefile_928_133266310023102000\main.exe
  "C:\Users\Admin\AppData\Local\Temp\WRV_Searcher_Lite.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_928_133266310023102000\main.exe

Filesize
8.8MB

MD5
6425df5e6a7f82461ff9fb197b60b272

SHA1
8956a2d6feb27c24dcd928865decab0545f3a613

SHA256
7b5dd19a59ff5ea2abc40f68d319c00c88caf769a3ed11c5a33be8ad67ae6a87

SHA512
6e6e5f97036c77510be6ebbafeb53ead582223ff288231daf23e6bb04ca4ec36c2f96ed3679df0b78a7444568a71e15fd9a14605255e5d5d3600f651f47460f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_928_133266310023102000\python310.dll

Filesize
4.3MB

MD5
63a1fa9259a35eaeac04174cecb90048

SHA1
0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

SHA256
14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

SHA512
896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_928_133266310023102000\main.exe

Filesize
8.8MB

MD5
6425df5e6a7f82461ff9fb197b60b272

SHA1
8956a2d6feb27c24dcd928865decab0545f3a613

SHA256
7b5dd19a59ff5ea2abc40f68d319c00c88caf769a3ed11c5a33be8ad67ae6a87

SHA512
6e6e5f97036c77510be6ebbafeb53ead582223ff288231daf23e6bb04ca4ec36c2f96ed3679df0b78a7444568a71e15fd9a14605255e5d5d3600f651f47460f7

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_928_133266310023102000\python310.dll

Filesize
4.3MB

MD5
63a1fa9259a35eaeac04174cecb90048

SHA1
0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

SHA256
14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

SHA512
896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

Download Submit
memory/928-183-0x000000013FD20000-0x000000014038C000-memory.dmp

Filesize
6.4MB

Download
memory/928-184-0x000000013FD20000-0x000000014038C000-memory.dmp

Filesize
6.4MB

Download
memory/1808-121-0x000000013F020000-0x000000013F90C000-memory.dmp

Filesize
8.9MB

Download