b648a39d90b072f6ddcc51c4385b91c6ccf8f09f07cff7214468efe096315d91

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2023, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LIST1101.exe
Size 429KB
Sample230619-raznlsfd7w
SHA256 b648a39d90b072f6ddcc51c4385b91c6ccf8f09f07cff7214468efe096315d91
MD5 601325c72030d93334059be1394ccf0d
SHA1 ff4861d068e67cc11046923472e24df4e10f2709
SHA512 be9915f8b845a6a6abc4b32b5bb9db9492c0b52719fb05c7b423c7ef5a25a41596bef7ae5630f05008191986704b9078a2c1686739d0a13c9e258d39cd8cee1b
SSDEEP 12288:M1nWS46CFHhbIM/j6dZd60ErYI4wo10n0ICm8:eWj7F9/jCkYEoI0ICm8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
232	LIST1101.exe
232	LIST1101.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Intoxicable\Toksikologiens\Pseudepigraphon.Ned	LIST1101.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Camoufleurs\pavisers\Julie\forsgsdyr.Ken	LIST1101.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\LIST1101.exe
"C:\Users\Admin\AppData\Local\Temp\LIST1101.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
PID:232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq8A74.tmp\System.dll
Size 12KB
SHA256 ce36bf0aee943edddfd4c5634333da5cdeabc270c6ae56ecc39a344fde25e06a
MD5 b5f2250ac5c8821a68457d4ad341a1dd
SHA1 7b82c09b95ab9c113ef9a0d853aa05d9560d7fa2
SHA512 a632480c5588bd3026785cd0220dbf489489032c6c47096e94abf9e812813e12d07d021cf2ef6734a04288f4b6786d3c2d31e218d86e28394f3eb4ecf0c49f63
SSDEEP 192:SNA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:uR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq8A74.tmp\System.dll
Size 12KB
SHA256 ce36bf0aee943edddfd4c5634333da5cdeabc270c6ae56ecc39a344fde25e06a
MD5 b5f2250ac5c8821a68457d4ad341a1dd
SHA1 7b82c09b95ab9c113ef9a0d853aa05d9560d7fa2
SHA512 a632480c5588bd3026785cd0220dbf489489032c6c47096e94abf9e812813e12d07d021cf2ef6734a04288f4b6786d3c2d31e218d86e28394f3eb4ecf0c49f63
SSDEEP 192:SNA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:uR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq8A74.tmp\System.dll
Size 12KB
SHA256 ce36bf0aee943edddfd4c5634333da5cdeabc270c6ae56ecc39a344fde25e06a
MD5 b5f2250ac5c8821a68457d4ad341a1dd
SHA1 7b82c09b95ab9c113ef9a0d853aa05d9560d7fa2
SHA512 a632480c5588bd3026785cd0220dbf489489032c6c47096e94abf9e812813e12d07d021cf2ef6734a04288f4b6786d3c2d31e218d86e28394f3eb4ecf0c49f63
SSDEEP 192:SNA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:uR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads