00b17c6b0557469b5e30d2648503bdcfc2196a05909498aff8ccd1da7ccdd8e2

Analysis

max time kernel
128s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

FB_1.6.16_Plus_Asion_20230321074507.exe
Size

22.7MB
MD5

9bb46f6a44abc36906ae1c14374fb993
SHA1

26355e7a927e5a4348f2dcd29347004f173fcdd4
SHA256

00b17c6b0557469b5e30d2648503bdcfc2196a05909498aff8ccd1da7ccdd8e2
SHA512

e07fb448d92d596f4f48f27cc784681ee9eb459f4329753a030841c6291a6f28af7b815a6268ca00069dfb02256765ea53b441da65eddc248569da71f9832721
SSDEEP

393216:NHxvcaht76oPnjyVgGizdf0bhO+NhjjOyaEpbSU/rQKnTMAoMuzouLJMuD9:RCwt76ofjyV8XyaSumrQ4TMAoMpuim

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
1340	FB_1.6.16_Plus_Asion_20230321074507.exe
1340	FB_1.6.16_Plus_Asion_20230321074507.exe
1340	FB_1.6.16_Plus_Asion_20230321074507.exe
1340	FB_1.6.16_Plus_Asion_20230321074507.exe
1340	FB_1.6.16_Plus_Asion_20230321074507.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1340	FB_1.6.16_Plus_Asion_20230321074507.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1340	FB_1.6.16_Plus_Asion_20230321074507.exe

C:\Users\Admin\AppData\Local\Temp\FB_1.6.16_Plus_Asion_20230321074507.exe
"C:\Users\Admin\AppData\Local\Temp\FB_1.6.16_Plus_Asion_20230321074507.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso146E.tmp\ButtonEvent.dll

Filesize
5KB

MD5
c24568a3b0d7c8d7761e684eb77252b5

SHA1
66db7f147cbc2309d8d78fdce54660041acbc60d

SHA256
e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d

SHA512
5d43e4c838fd7f4c6a4ab6cc6d63e0f81d765d9ca33d9278d082c4f75f9416907df10b003e10edc1b5ef39535f722d8dbfab114775ac67da7f9390dcc2b4b443

Download Submit
\Users\Admin\AppData\Local\Temp\nso146E.tmp\FindProcDLL.dll

Filesize
27KB

MD5
6f73b00aef6c49eac62128ef3eca677e

SHA1
1b6aff67d570e5ee61af2376247590eb49b728a1

SHA256
6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9

SHA512
678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938

Download Submit
\Users\Admin\AppData\Local\Temp\nso146E.tmp\System.dll

Filesize
12KB

MD5
e15ab1ebc8ac4fa11c72786ff15983f4

SHA1
210eb86f026c084251faeac304dfe96f0b26790e

SHA256
b60a0b9bdea234928d7eb849d931be78a210087418ac1032b4c71bf9a2204fd5

SHA512
712d2a4485727105255907a412d72fe1ed623dfa73c86510245a2096901ae365c9ef20bf6d1590fc2f93ee35f0d7ac214e087448a20df2c98ff8f09da5fce860

Download Submit
\Users\Admin\AppData\Local\Temp\nso146E.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
\Users\Admin\AppData\Local\Temp\nso146E.tmp\nsDialogs.dll

Filesize
9KB

MD5
24e0f85ce65002b8a2164cba1eebedb6

SHA1
682be561c5218cf95091e6e92c991844e70ffe71

SHA256
6229736e932dcf05038b743c5990bf9f256b724b862fa1471007fe6e722ad8d6

SHA512
8ff9faa1b2e01014b91cb489b038186f7a77f6366dad71476e8486f0898fa09dde06fc8b3bf6229fc77d1182f474c5654779bda2a4502c09a01b0e188f356b6e

Download Submit
memory/1340-68-0x00000000006F0000-0x00000000006FA000-memory.dmp

Filesize
40KB

Download