78a28b25b330513649439305a5d9293cb07fb796ad6521ef31f39a5453a549d8

Resubmissions

07-09-2023 14:45

230907-r45fysaf5s 10

07-09-2023 14:12

230907-rjbyxaad5s 10

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe
Size

192KB
MD5

06dfde68d9e07bc1191626855a321801
SHA1

a17859092783b09986512203119bbfaf4f5e13b0
SHA256

719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244
SHA512

9d4f64e297e694d49ff4eee734afaf48945cf1b0d991dff707253266a10603994edaa6a68ad614118d50925e25a9f9f405ca60b15c4c0d4464175e80c0cfc2df
SSDEEP

6144:fB+pgUn26IdSI1dwCi6PgHGcUHTaF+MW1D:fgPCdp1dJkHFUHT7M

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1376	719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1376 set thread context of 2664	1376	719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2664	719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1376	719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 2664	1376	719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe	28
PID 1376 wrote to memory of 2664	1376	719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe	28
PID 1376 wrote to memory of 2664	1376	719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe	28
PID 1376 wrote to memory of 2664	1376	719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe	28
PID 1376 wrote to memory of 2664	1376	719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe	28
PID 1376 wrote to memory of 2664	1376	719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe	28
PID 1376 wrote to memory of 2664	1376	719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe	28
PID 1376 wrote to memory of 2664	1376	719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe	28

C:\Users\Admin\AppData\Local\Temp\719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe
"C:\Users\Admin\AppData\Local\Temp\719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe
  "C:\Users\Admin\AppData\Local\Temp\719a339594bae94aad390edd6afd0f784af416eb53b6bc64de024a55567d4244.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst8133.tmp\System.dll

Filesize
11KB

MD5
a4dd044bcd94e9b3370ccf095b31f896

SHA1
17c78201323ab2095bc53184aa8267c9187d5173

SHA256
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

SHA512
87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

Download Submit
memory/1376-12-0x00000000003D0000-0x00000000003ED000-memory.dmp

Filesize
116KB

Download
memory/1376-15-0x00000000003D0000-0x00000000003ED000-memory.dmp

Filesize
116KB

Download
memory/2664-14-0x00000000001D0000-0x00000000001EC000-memory.dmp

Filesize
112KB

Download
memory/2664-16-0x0000000000940000-0x0000000000C43000-memory.dmp

Filesize
3.0MB

Download