a537283e652fc63c91b592a6c5a7cbbb286da7fb6c8dbe9214bdfbf150cc995d

Analysis

max time kernel
21s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2023, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a537283e652fc63c91b592a6c5a7cbbb286da7fb6c8dbe9214bdfbf150cc995d.exe
Size

320KB
MD5

78a14bcd3b2a961319a19b2bf2ae0d6b
SHA1

5580c9b82bd82e3e904535b94cb046ef4ff46d6f
SHA256

a537283e652fc63c91b592a6c5a7cbbb286da7fb6c8dbe9214bdfbf150cc995d
SHA512

79377554a7e0a87258673813ede6de6d7eaebdf2bf2919d6c522d8eedcdab70bb72bba2e7e96a3fe5803ec4e4af3c05b888e2476eb43d59bc757e0c36680e701
SSDEEP

6144:fQ606x5wOyFNKvLOsI5H8T/87vV7HlZ3vYZawHox:/wDSvysI58/8x7FZEox

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4660	a537283e652fc63c91b592a6c5a7cbbb286da7fb6c8dbe9214bdfbf150cc995d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Beans\pasformers.Nea	a537283e652fc63c91b592a6c5a7cbbb286da7fb6c8dbe9214bdfbf150cc995d.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\Standardstik\Maculations.Bis	a537283e652fc63c91b592a6c5a7cbbb286da7fb6c8dbe9214bdfbf150cc995d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a537283e652fc63c91b592a6c5a7cbbb286da7fb6c8dbe9214bdfbf150cc995d.exe
"C:\Users\Admin\AppData\Local\Temp\a537283e652fc63c91b592a6c5a7cbbb286da7fb6c8dbe9214bdfbf150cc995d.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\a537283e652fc63c91b592a6c5a7cbbb286da7fb6c8dbe9214bdfbf150cc995d.exe"
  2⤵
  PID:4456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\a537283e652fc63c91b592a6c5a7cbbb286da7fb6c8dbe9214bdfbf150cc995d.exe"
  2⤵
  PID:4676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nscA771.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
memory/4676-148-0x0000000000400000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download