Resubmissions
08/10/2025, 21:01
251008-zt27vatvfs1012/07/2023, 04:20
230712-ex384abh231022/06/2020, 15:01
200622-87haxcmv2e10Analysis
- max time kernel
141s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
12/07/2023, 04:20
General
- Target 870acd0ca66986cc20ab0a655fbc5873.exe
- Size 493KB
- Sample230712-ex384abh23
- SHA256 085256b114079911b64f5826165f85a28a2a4ddc2ce0d935fa8545651ce5ab09
Malware Config
Signatures
- Ordinypt
Ordinypt is a destructive wiper malware that works in a way similar to ransomware.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\870acd0ca66986cc20ab0a655fbc5873.exe"C:\Users\Admin\AppData\Local\Temp\870acd0ca66986cc20ab0a655fbc5873.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Wo_sind_meine_Dateien.html
memory/5068-1339-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5068-1342-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5068-210-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5068-630-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5068-1198-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5068-1337-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5068-142-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5068-1340-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5068-1338-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5068-1341-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5068-141-0x0000000002310000-0x0000000002311000-memory.dmp
memory/5068-1343-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5068-1344-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5068-1345-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5068-1346-0x0000000000400000-0x0000000000482000-memory.dmp