d137bdb8a3daec094c4ab9d2e85680e6d0d299ba9d08801de1cdd55a46564db8

Analysis

max time kernel
106s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/06/2023, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

om_inst.exe
Size

1.1MB
MD5

29e506e99f198025272d62565a50c38d
SHA1

4fe0db4685ebd2cfd5f53ab9a62d2cacf9414b55
SHA256

d137bdb8a3daec094c4ab9d2e85680e6d0d299ba9d08801de1cdd55a46564db8
SHA512

21323ebf3a63d9dccb75edb8446e36aedf501de878ba6c461d3408b69c9c680a1b308b067f982d39d892113ede4d8d16de05fe1adcc91493bb97c63115285e9e
SSDEEP

24576:UkYSksZWD2ek8n4dpoEieoXcMd1hZcF/1udYBHjkOZNn:flkb2e1zcMcFcd0HjkaNn

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1988	is-82JF3.tmp

Loads dropped DLL 3 IoCs

pid	Process
2024	om_inst.exe
1988	is-82JF3.tmp
1988	is-82JF3.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1988	2024	om_inst.exe	26
PID 2024 wrote to memory of 1988	2024	om_inst.exe	26
PID 2024 wrote to memory of 1988	2024	om_inst.exe	26
PID 2024 wrote to memory of 1988	2024	om_inst.exe	26
PID 2024 wrote to memory of 1988	2024	om_inst.exe	26
PID 2024 wrote to memory of 1988	2024	om_inst.exe	26
PID 2024 wrote to memory of 1988	2024	om_inst.exe	26

C:\Users\Admin\AppData\Local\Temp\om_inst.exe
"C:\Users\Admin\AppData\Local\Temp\om_inst.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\is-8V8OK.tmp\is-82JF3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8V8OK.tmp\is-82JF3.tmp" /SL4 $70124 C:\Users\Admin\AppData\Local\Temp\om_inst.exe 980897 50688
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-8V8OK.tmp\is-82JF3.tmp

Filesize
588KB

MD5
ada0596f481e037ab4eb86fcb10e827e

SHA1
ef03245a6479799c3946b5cee16ef1dd72c46a8d

SHA256
cf66bee55697b7bab60bdf17898af35528887ebc916a12c3510189629bf17967

SHA512
1fe891effa732e37ec997894fddb847553e83a64dccf650fa00ab95027f52b2845b318dc836e5487835c4da18559c1de6731af592f81a39f80dd23ef2111ac88

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8V8OK.tmp\is-82JF3.tmp

Filesize
588KB

MD5
ada0596f481e037ab4eb86fcb10e827e

SHA1
ef03245a6479799c3946b5cee16ef1dd72c46a8d

SHA256
cf66bee55697b7bab60bdf17898af35528887ebc916a12c3510189629bf17967

SHA512
1fe891effa732e37ec997894fddb847553e83a64dccf650fa00ab95027f52b2845b318dc836e5487835c4da18559c1de6731af592f81a39f80dd23ef2111ac88

Download Submit
\Users\Admin\AppData\Local\Temp\is-8V8OK.tmp\is-82JF3.tmp

Filesize
588KB

MD5
ada0596f481e037ab4eb86fcb10e827e

SHA1
ef03245a6479799c3946b5cee16ef1dd72c46a8d

SHA256
cf66bee55697b7bab60bdf17898af35528887ebc916a12c3510189629bf17967

SHA512
1fe891effa732e37ec997894fddb847553e83a64dccf650fa00ab95027f52b2845b318dc836e5487835c4da18559c1de6731af592f81a39f80dd23ef2111ac88

Download Submit
\Users\Admin\AppData\Local\Temp\is-N984A.tmp\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-N984A.tmp\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1988-67-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1988-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1988-87-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1988-89-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2024-54-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2024-68-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2024-90-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download