10425a9eff200ad914046f3b097b0c08b8cc3999ac205e25669b9fe0bcc25484

Analysis

max time kernel
116s
max time network
121s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
15/08/2023, 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10425a9eff200ad914046f3b097b0c08b8cc3999ac205e25669b9fe0bcc25484.exe
Size

2.0MB
MD5

da9991b5ce43fe91744b1601add26005
SHA1

40577d58f578cd3e0aa49fed47d0651767d9f18d
SHA256

10425a9eff200ad914046f3b097b0c08b8cc3999ac205e25669b9fe0bcc25484
SHA512

95d004cd99286f00b1a3a3b3587fa8b2f0bb75aa9649d59ce931020a69a2e043b0ecf7f779ecae1320028d73c8551f4966d0748c84cbe7133588be9cdc94aefa
SSDEEP

49152:8cbi6+WPI/WF0GImE/jyWLFwVrWcyQjNHMfB9WVKdT/WAj:8cbheWFNI3byWLC1ly6NsfB9SKR/d

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4588	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 4588	2600	10425a9eff200ad914046f3b097b0c08b8cc3999ac205e25669b9fe0bcc25484.exe	70
PID 2600 wrote to memory of 4588	2600	10425a9eff200ad914046f3b097b0c08b8cc3999ac205e25669b9fe0bcc25484.exe	70
PID 2600 wrote to memory of 4588	2600	10425a9eff200ad914046f3b097b0c08b8cc3999ac205e25669b9fe0bcc25484.exe	70

C:\Users\Admin\AppData\Local\Temp\10425a9eff200ad914046f3b097b0c08b8cc3999ac205e25669b9fe0bcc25484.exe
"C:\Users\Admin\AppData\Local\Temp\10425a9eff200ad914046f3b097b0c08b8cc3999ac205e25669b9fe0bcc25484.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -u /s .\IJcMj.KDW
  2⤵
  - Loads dropped DLL
  PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IJcMj.KDW

Filesize
1.8MB

MD5
b93412b4beac38ed922c9f78e8743b89

SHA1
646568a9058b6d56b86e79346588f2f8d71fc702

SHA256
68e688337c4e6d2c354da8b940a09306eaf8c6027175b9f31d7224628ec3e289

SHA512
07e557427c674eb08f9e0afae0d9378820df5569b05baa7b032e1b99f248810a8fe88019901d9f134ac291df67c7428231e3373df963b96ca3289738673b9698

Download Submit
\Users\Admin\AppData\Local\Temp\ijcmj.KdW

Filesize
1.8MB

MD5
b93412b4beac38ed922c9f78e8743b89

SHA1
646568a9058b6d56b86e79346588f2f8d71fc702

SHA256
68e688337c4e6d2c354da8b940a09306eaf8c6027175b9f31d7224628ec3e289

SHA512
07e557427c674eb08f9e0afae0d9378820df5569b05baa7b032e1b99f248810a8fe88019901d9f134ac291df67c7428231e3373df963b96ca3289738673b9698

Download Submit
memory/4588-128-0x0000000000F30000-0x0000000000F36000-memory.dmp

Filesize
24KB

Download
memory/4588-129-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/4588-132-0x0000000004D80000-0x0000000004E85000-memory.dmp

Filesize
1.0MB

Download
memory/4588-133-0x0000000004E90000-0x0000000004F7B000-memory.dmp

Filesize
940KB

Download
memory/4588-136-0x0000000004E90000-0x0000000004F7B000-memory.dmp

Filesize
940KB

Download
memory/4588-137-0x0000000004E90000-0x0000000004F7B000-memory.dmp

Filesize
940KB

Download