89fd567270112eb3494cd4253f2babe024465e60fb28c64800901ccdb3d7fdd2

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2023, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
992a0de4e5038847edbe7f400f3ccfd2.exe
Size 248KB
Sample230510-e1c63sgb7t
SHA256 89fd567270112eb3494cd4253f2babe024465e60fb28c64800901ccdb3d7fdd2
MD5 992a0de4e5038847edbe7f400f3ccfd2
SHA1 d5444b3bf9c46a414f3d10a7ebac82e45d2d0db1
SHA512 887bb358eac4cf8c57c158a2884d13cebac261f3f219e195a60ea4177c5de29787545ebcbce63c3e95c7201dc246162da6e2dbd43c8cdc8313586fd5ca2f4380
SSDEEP 6144:/Ya6X4S/Vhzfg2NyrZlzEiTRxVaWVQw3KCFnI:/YVLNdRyVlzdRxgWV4MnI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4804	992a0de4e5038847edbe7f400f3ccfd2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4804 set thread context of 1276	4804	992a0de4e5038847edbe7f400f3ccfd2.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1276	992a0de4e5038847edbe7f400f3ccfd2.exe
1276	992a0de4e5038847edbe7f400f3ccfd2.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4804	992a0de4e5038847edbe7f400f3ccfd2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 1276	4804	992a0de4e5038847edbe7f400f3ccfd2.exe	81
PID 4804 wrote to memory of 1276	4804	992a0de4e5038847edbe7f400f3ccfd2.exe	81
PID 4804 wrote to memory of 1276	4804	992a0de4e5038847edbe7f400f3ccfd2.exe	81
PID 4804 wrote to memory of 1276	4804	992a0de4e5038847edbe7f400f3ccfd2.exe	81

C:\Users\Admin\AppData\Local\Temp\992a0de4e5038847edbe7f400f3ccfd2.exe
"C:\Users\Admin\AppData\Local\Temp\992a0de4e5038847edbe7f400f3ccfd2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\992a0de4e5038847edbe7f400f3ccfd2.exe
  "C:\Users\Admin\AppData\Local\Temp\992a0de4e5038847edbe7f400f3ccfd2.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tlvzjfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy6BD0.tmp\tlvzjfo.dll
Size 5KB
SHA256 5d00aff6491b553ed5ff7d0a318dd7e5d1098b89bd51f1855e6e02b0e5b9aaf8
MD5 b5a2e87838575e22675adc4ae310c27b
SHA1 b6dc633287cdb0316ab512517d51b7fc8e4aec76
SHA512 55372a81f2f40467e203c13d13348f5d1e9d9064668262cbd8574379ff3b1cf054b7be299900f5eb22c267cd88e49c59264dddac820d6e74d2768aca99c16c63
SSDEEP 48:SHbUR4r6tMbqUBCbq92hd25DwChgq/d0TMd9Ml0N/a7iaa5y:MrhbbCa9wChJV0AdsyOLa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1276-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1276-141-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1276-144-0x0000000000A70000-0x0000000000DBA000-memory.dmp

Download

memory/4804-139-0x00000000022D0000-0x00000000022D2000-memory.dmp

Download