c684873dfb34beb1c8d2b18792efa33e4641bb84f68177f263fcfefb59aa03ce

Analysis

max time kernel
127s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-06-2023 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

srcl_upd_1.11.0.exe
Size

13.4MB
MD5

bb79d464759b84858d405298897c031b
SHA1

44714f78a6f36a1e6394f13deffbc41d753fb20d
SHA256

c684873dfb34beb1c8d2b18792efa33e4641bb84f68177f263fcfefb59aa03ce
SHA512

6f90e543301d389b412601081e5fac9362636948b1eb0e435e48a5b3baa742074737fa0f32b80662bacb32b451c4390438f9b9805788c17a1513a0b31de07f4b
SSDEEP

393216:Ft4SnffzH3FPmJl04EGZL0foMHNitQYfOdL+7e2:f4SfrH2tUiiYfOdL+C2

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2036	srcl_upd_1.11.0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	srcl_upd_1.11.0.exe

C:\Users\Admin\AppData\Local\Temp\srcl_upd_1.11.0.exe
"C:\Users\Admin\AppData\Local\Temp\srcl_upd_1.11.0.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst7090.tmp\LangDLL.dll

Filesize
5KB

MD5
de3558ce305e32f742ff25b697407fec

SHA1
d55c50c546001421647f2e91780c324dbb8d6ebb

SHA256
98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a

SHA512
7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac

Download Submit