b1c7d85b71168a227630f11b74f10aead1d659a5ac9353bbd2a64f89a4f09561

Analysis

max time kernel
136s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2023, 14:40 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe
Size

361KB
MD5

995af99408580d7fc0646715b7415b37
SHA1

9bdfce77846bfa373a88373b009df76d1bae191e
SHA256

b1c7d85b71168a227630f11b74f10aead1d659a5ac9353bbd2a64f89a4f09561
SHA512

83938ad4fc0b29aa26c84cdbdb5e912e99a86e3f327aba2e13eba4c5e8455134eaa091a54fc837a714ab9dc044fc1c501001a192168e05e9763b1bbc84c6d51b
SSDEEP

6144:/Ya60G4z100ZEfEWCTCC6aXpJoubyFp/Zm4uhLZDGNZEQ:/Y6G4zlZEfEZC7gJoubim4u5A/

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
488	SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 488 set thread context of 4016	488	SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4016	SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe
4016	SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
488	SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 4016	488	SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe	83
PID 488 wrote to memory of 4016	488	SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe	83
PID 488 wrote to memory of 4016	488	SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe	83
PID 488 wrote to memory of 4016	488	SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe	83

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:488
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4016

Network

DNS

8.3.197.209.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.3.197.209.in-addr.arpa

IN PTR

Response

8.3.197.209.in-addr.arpa

IN PTR

vip0x008map2sslhwcdnnet
DNS

1.77.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.77.109.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

8.3.197.209.in-addr.arpa

dns

70 B
111 B
1
1

DNS Request

8.3.197.209.in-addr.arpa
8.8.8.8:53

1.77.109.52.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

1.77.109.52.in-addr.arpa

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nss1896.tmp\vwyvequl.dll

Filesize
255KB

MD5
f3988fcf1d4348e0f71022b513b964cf

SHA1
e93061c33aadf7c7c70c1f077153a3c8446d08ce

SHA256
c32338cfc3b63975693a3e49a0a2d4d08a832b9ecc65e6f18b25140790df2de2

SHA512
124e1058ef2164c8d81dc7150b3acd9db5487f3ba6843c09bdc1e41f5061737a863be34e00ee0823a8e6c0127ae285d6c04dfbad1f1d81431ea23372407d5a3c

Download Submit
memory/488-139-0x0000000003140000-0x0000000003142000-memory.dmp

Filesize
8KB

Download
memory/4016-140-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4016-141-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4016-142-0x0000000000B20000-0x0000000000E6A000-memory.dmp

Filesize
3.3MB

Download
memory/4016-143-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download