d137bdb8a3daec094c4ab9d2e85680e6d0d299ba9d08801de1cdd55a46564db8

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2023, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

om_inst.exe
Size

1.1MB
MD5

29e506e99f198025272d62565a50c38d
SHA1

4fe0db4685ebd2cfd5f53ab9a62d2cacf9414b55
SHA256

d137bdb8a3daec094c4ab9d2e85680e6d0d299ba9d08801de1cdd55a46564db8
SHA512

21323ebf3a63d9dccb75edb8446e36aedf501de878ba6c461d3408b69c9c680a1b308b067f982d39d892113ede4d8d16de05fe1adcc91493bb97c63115285e9e
SSDEEP

24576:UkYSksZWD2ek8n4dpoEieoXcMd1hZcF/1udYBHjkOZNn:flkb2e1zcMcFcd0HjkaNn

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4564	is-2L698.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4564	4680	om_inst.exe	84
PID 4680 wrote to memory of 4564	4680	om_inst.exe	84
PID 4680 wrote to memory of 4564	4680	om_inst.exe	84

C:\Users\Admin\AppData\Local\Temp\om_inst.exe
"C:\Users\Admin\AppData\Local\Temp\om_inst.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\is-5MO7N.tmp\is-2L698.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5MO7N.tmp\is-2L698.tmp" /SL4 $8003C C:\Users\Admin\AppData\Local\Temp\om_inst.exe 980897 50688
  2⤵
  - Executes dropped EXE
  PID:4564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-5MO7N.tmp\is-2L698.tmp

Filesize
588KB

MD5
ada0596f481e037ab4eb86fcb10e827e

SHA1
ef03245a6479799c3946b5cee16ef1dd72c46a8d

SHA256
cf66bee55697b7bab60bdf17898af35528887ebc916a12c3510189629bf17967

SHA512
1fe891effa732e37ec997894fddb847553e83a64dccf650fa00ab95027f52b2845b318dc836e5487835c4da18559c1de6731af592f81a39f80dd23ef2111ac88

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5MO7N.tmp\is-2L698.tmp

Filesize
588KB

MD5
ada0596f481e037ab4eb86fcb10e827e

SHA1
ef03245a6479799c3946b5cee16ef1dd72c46a8d

SHA256
cf66bee55697b7bab60bdf17898af35528887ebc916a12c3510189629bf17967

SHA512
1fe891effa732e37ec997894fddb847553e83a64dccf650fa00ab95027f52b2845b318dc836e5487835c4da18559c1de6731af592f81a39f80dd23ef2111ac88

Download Submit
memory/4564-142-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/4564-144-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4564-162-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4564-164-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4680-133-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4680-143-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4680-165-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download