36a28f5eebc2c87b065ba1ff1ded73b25a4f8e0f55aaff21179baac6cd15c4d8

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2023, 11:37

Target
LICK_Credit_Return.exe
Size 2.4MB
Sample230518-nrc96aaf33
SHA256 f9d30714fb0e87894da5d0a690375eb17b66652b0aacd24ba336bb166f9e5efe
MD5 3f810c13d21fa903e0e9c9daf93f7a8b
SHA1 17a27b25bbe260ee45b50a181d2c04030238a1a9
SHA512 a031e87037ff964c6612f24eb785515926ddd8b23fa58e313df4ae94a023a60849d92d2f97976c2bc0542f52f15e9eb63fefdddc0d90aa487be36667b45a6e3a
SSDEEP 49152:PHkWk5cS7a+9XYaQ1Zehc4mTYJ78V9gyBn4cH4cefmP/SA8N:P/ajJ+Z942KQV9hp4IefmP/SA8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1760	2276	LICK_Credit_Return.exe	84
PID 2276 wrote to memory of 1760	2276	LICK_Credit_Return.exe	84
PID 2276 wrote to memory of 1760	2276	LICK_Credit_Return.exe	84

C:\Users\Admin\AppData\Local\Temp\LICK_Credit_Return.exe
"C:\Users\Admin\AppData\Local\Temp\LICK_Credit_Return.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1760

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact