28cbde718196e338f07826552d54c2770b8867e9660d88069fd0891e5f61dfc6

Analysis

max time kernel
141s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vnc-E4_4_2-x86_x64_win32.exe
Size

5.0MB
MD5

5a7668c3617dfa470aef4a83ee98d5ff
SHA1

96f0f3191062aa55e72917c8ff8708df4533ed32
SHA256

28cbde718196e338f07826552d54c2770b8867e9660d88069fd0891e5f61dfc6
SHA512

a7f1a464134cc9440248797e36e84c7b28859a01cd70b322c40d17287601db657f4137c5ef74b11de754a5d3b24c7708e552b706a5f6e53330aca77b21a4822c
SSDEEP

98304:6lRZnybJ88KdUyJZfOFQEUB8iWZRN39S4URlW2PusY6yt4YCcKzbNGvsnHNS:ozRUyJZmFkBmDw4sc68xCcKz/N

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
760	vnc-E4_4_2-x86_x64_win32.tmp
4192	vncconfig.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 760	4592	vnc-E4_4_2-x86_x64_win32.exe	86
PID 4592 wrote to memory of 760	4592	vnc-E4_4_2-x86_x64_win32.exe	86
PID 4592 wrote to memory of 760	4592	vnc-E4_4_2-x86_x64_win32.exe	86
PID 760 wrote to memory of 4192	760	vnc-E4_4_2-x86_x64_win32.tmp	87
PID 760 wrote to memory of 4192	760	vnc-E4_4_2-x86_x64_win32.tmp	87
PID 760 wrote to memory of 4192	760	vnc-E4_4_2-x86_x64_win32.tmp	87

C:\Users\Admin\AppData\Local\Temp\vnc-E4_4_2-x86_x64_win32.exe
"C:\Users\Admin\AppData\Local\Temp\vnc-E4_4_2-x86_x64_win32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\is-7JOHP.tmp\vnc-E4_4_2-x86_x64_win32.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7JOHP.tmp\vnc-E4_4_2-x86_x64_win32.tmp" /SL5="$E01D2,5022000,53248,C:\Users\Admin\AppData\Local\Temp\vnc-E4_4_2-x86_x64_win32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Users\Admin\AppData\Local\Temp\is-V9P7P.tmp\vncconfig.exe
    "C:\Users\Admin\AppData\Local\Temp\is-V9P7P.tmp\vncconfig.exe" -checkLicense
    3⤵
    - Executes dropped EXE
    PID:4192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-7JOHP.tmp\vnc-E4_4_2-x86_x64_win32.tmp

Filesize
665KB

MD5
9e30ab5e3f6b43f69f928e6b4fcfd604

SHA1
b110f04114c52f2439715cbad3769250dbcdb1b3

SHA256
affbe7f0320f9602d8c51468ecb7bc7960df4f62ab1a36c05ac2fe2816d175ba

SHA512
8d751d8c8023bbd54ea2ea0969ad9f379d8bf1066980fdd58007e778bdf654e4e13264ac8917be91ac8583ea9ae5536ca600530f413cbd887c234ec60be5a45d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7JOHP.tmp\vnc-E4_4_2-x86_x64_win32.tmp

Filesize
665KB

MD5
9e30ab5e3f6b43f69f928e6b4fcfd604

SHA1
b110f04114c52f2439715cbad3769250dbcdb1b3

SHA256
affbe7f0320f9602d8c51468ecb7bc7960df4f62ab1a36c05ac2fe2816d175ba

SHA512
8d751d8c8023bbd54ea2ea0969ad9f379d8bf1066980fdd58007e778bdf654e4e13264ac8917be91ac8583ea9ae5536ca600530f413cbd887c234ec60be5a45d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-V9P7P.tmp\vncconfig.exe

Filesize
777KB

MD5
a4e433791285ea17ec3f4c43b37629f8

SHA1
73fbe682459dee8679895d10ba4231898e8bb040

SHA256
9585c0a7186e4cd43240f4b79f083c2b0afa45244a25a6b8212361d36ae548c9

SHA512
cbe760aa48901aafe1eba241b6795e4bb9c7b0007e226b0bee05a78e42dae161454eedfeb0963e7ef89ef2936b60e53855a0d3eac7939c6c41888873c8cada01

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-V9P7P.tmp\vncconfig.exe

Filesize
777KB

MD5
a4e433791285ea17ec3f4c43b37629f8

SHA1
73fbe682459dee8679895d10ba4231898e8bb040

SHA256
9585c0a7186e4cd43240f4b79f083c2b0afa45244a25a6b8212361d36ae548c9

SHA512
cbe760aa48901aafe1eba241b6795e4bb9c7b0007e226b0bee05a78e42dae161454eedfeb0963e7ef89ef2936b60e53855a0d3eac7939c6c41888873c8cada01

Download Submit
memory/760-140-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/760-152-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/760-153-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4592-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4592-150-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download