7537d2d83df8cd26afb93fe916f31860c885047ba3ff952d170c0f00554a6f56

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
07/07/2023, 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d35e867803700exeexeexeex.exe
Size

55KB
MD5

5d35e8678037005eadf86862c4f58e3b
SHA1

0a015bda5bea42b19b085738418f0a2e653b0059
SHA256

7537d2d83df8cd26afb93fe916f31860c885047ba3ff952d170c0f00554a6f56
SHA512

8602f2d11ca32b11c09a83fa004085c3d0851ffece273e113398ffcdb72453cf0b48ccb56f518bab74c04f5cd31c3ff712798c919c17c92dc4b2da316b965c49
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzp0oj67a:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7e

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
468	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
3052	5d35e867803700exeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3052	5d35e867803700exeexeexeex.exe
468	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 468	3052	5d35e867803700exeexeexeex.exe	27
PID 3052 wrote to memory of 468	3052	5d35e867803700exeexeexeex.exe	27
PID 3052 wrote to memory of 468	3052	5d35e867803700exeexeexeex.exe	27
PID 3052 wrote to memory of 468	3052	5d35e867803700exeexeexeex.exe	27

C:\Users\Admin\AppData\Local\Temp\5d35e867803700exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\5d35e867803700exeexeexeex.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
56KB

MD5
25eaa9ee063b1516c787b74ae6987237

SHA1
19f159fca8271da8bc5948658ddd1d6700e32332

SHA256
874b4784edb610b6d2d2008c7f3b040ca53c2b7ecfef34aa657845cf9c33ada5

SHA512
be05796368f90d815fa5584b253e3dfb599e843ea99bcec6cd114733e87d585b37edc4d0fe0377886a30ac0c0c6e8660b9d7d24c79e08de5e7b71da35c3161d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
56KB

MD5
25eaa9ee063b1516c787b74ae6987237

SHA1
19f159fca8271da8bc5948658ddd1d6700e32332

SHA256
874b4784edb610b6d2d2008c7f3b040ca53c2b7ecfef34aa657845cf9c33ada5

SHA512
be05796368f90d815fa5584b253e3dfb599e843ea99bcec6cd114733e87d585b37edc4d0fe0377886a30ac0c0c6e8660b9d7d24c79e08de5e7b71da35c3161d1

Download Submit
\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
56KB

MD5
25eaa9ee063b1516c787b74ae6987237

SHA1
19f159fca8271da8bc5948658ddd1d6700e32332

SHA256
874b4784edb610b6d2d2008c7f3b040ca53c2b7ecfef34aa657845cf9c33ada5

SHA512
be05796368f90d815fa5584b253e3dfb599e843ea99bcec6cd114733e87d585b37edc4d0fe0377886a30ac0c0c6e8660b9d7d24c79e08de5e7b71da35c3161d1

Download Submit
memory/3052-54-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/3052-55-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download