d8bf2dbd08a8ed5de6cca3ed6dd10644b09a85eea3430a106dffb8dbfcd29faf

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
27-08-2023 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8bf2dbd08a8ed5de6cca3ed6dd10644b09a85eea3430a106dffb8dbfcd29faf.exe
Size

197KB
MD5

1da3503d30a6ff8b858b0bfdbe68e9fa
SHA1

4e89275ce7d278d272616667ff739070f5430f5e
SHA256

d8bf2dbd08a8ed5de6cca3ed6dd10644b09a85eea3430a106dffb8dbfcd29faf
SHA512

98e9d7e045a92a0ca5f594149e0a965af20ce8947162f8df43940e1c9026ce586954080a22de3ee3184ede691574951ebadf37418cf3487ac70ddf670fa99f8b
SSDEEP

3072:qfY/TU9fE9PEtuAbG4IJpg5W+BGIk+bVUExW9JDsALwwedTOg4:8Ya6SGXJpAvBGITpwJDsALe4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1192	Un_A.exe

Loads dropped DLL 2 IoCs

pid	Process
2828	d8bf2dbd08a8ed5de6cca3ed6dd10644b09a85eea3430a106dffb8dbfcd29faf.exe
1192	Un_A.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1192	Un_A.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1192	2828	d8bf2dbd08a8ed5de6cca3ed6dd10644b09a85eea3430a106dffb8dbfcd29faf.exe	30
PID 2828 wrote to memory of 1192	2828	d8bf2dbd08a8ed5de6cca3ed6dd10644b09a85eea3430a106dffb8dbfcd29faf.exe	30
PID 2828 wrote to memory of 1192	2828	d8bf2dbd08a8ed5de6cca3ed6dd10644b09a85eea3430a106dffb8dbfcd29faf.exe	30
PID 2828 wrote to memory of 1192	2828	d8bf2dbd08a8ed5de6cca3ed6dd10644b09a85eea3430a106dffb8dbfcd29faf.exe	30

C:\Users\Admin\AppData\Local\Temp\d8bf2dbd08a8ed5de6cca3ed6dd10644b09a85eea3430a106dffb8dbfcd29faf.exe
"C:\Users\Admin\AppData\Local\Temp\d8bf2dbd08a8ed5de6cca3ed6dd10644b09a85eea3430a106dffb8dbfcd29faf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
197KB

MD5
1da3503d30a6ff8b858b0bfdbe68e9fa

SHA1
4e89275ce7d278d272616667ff739070f5430f5e

SHA256
d8bf2dbd08a8ed5de6cca3ed6dd10644b09a85eea3430a106dffb8dbfcd29faf

SHA512
98e9d7e045a92a0ca5f594149e0a965af20ce8947162f8df43940e1c9026ce586954080a22de3ee3184ede691574951ebadf37418cf3487ac70ddf670fa99f8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
197KB

MD5
1da3503d30a6ff8b858b0bfdbe68e9fa

SHA1
4e89275ce7d278d272616667ff739070f5430f5e

SHA256
d8bf2dbd08a8ed5de6cca3ed6dd10644b09a85eea3430a106dffb8dbfcd29faf

SHA512
98e9d7e045a92a0ca5f594149e0a965af20ce8947162f8df43940e1c9026ce586954080a22de3ee3184ede691574951ebadf37418cf3487ac70ddf670fa99f8b

Download Submit
\Users\Admin\AppData\Local\Temp\nsyF430.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
197KB

MD5
1da3503d30a6ff8b858b0bfdbe68e9fa

SHA1
4e89275ce7d278d272616667ff739070f5430f5e

SHA256
d8bf2dbd08a8ed5de6cca3ed6dd10644b09a85eea3430a106dffb8dbfcd29faf

SHA512
98e9d7e045a92a0ca5f594149e0a965af20ce8947162f8df43940e1c9026ce586954080a22de3ee3184ede691574951ebadf37418cf3487ac70ddf670fa99f8b

Download Submit