da375a209987a2c6b866cc6c15335c844b3bc0666b20ea0df73b8a68a0879f02

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18-09-2023 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da375a209987a2c6b866cc6c15335c844b3bc0666b20ea0df73b8a68a0879f02.exe
Size

56KB
MD5

55a6857983149c900d6d6b8044545968
SHA1

7ca1a8b9ded8fa8f30ba7c45166f7d08f724a22e
SHA256

da375a209987a2c6b866cc6c15335c844b3bc0666b20ea0df73b8a68a0879f02
SHA512

927308bc80afea2e59787bea8144ccc3188dd5562418dbce004ad5a719de022700a8812de52f0aa206deef6ac1a7c36a85dfc10a543f87f1103df5e73790f96e
SSDEEP

1536:asuNLvSFVVeozLpPuvgdLeAyNTQ20JglqcS:a1NjcVVnLpPuvceA920JgS

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1516	Un_A.exe

Executes dropped EXE 1 IoCs

pid	Process
1516	Un_A.exe

Loads dropped DLL 2 IoCs

pid	Process
2220	da375a209987a2c6b866cc6c15335c844b3bc0666b20ea0df73b8a68a0879f02.exe
1516	Un_A.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1516	Un_A.exe
1516	Un_A.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1516	2220	da375a209987a2c6b866cc6c15335c844b3bc0666b20ea0df73b8a68a0879f02.exe	28
PID 2220 wrote to memory of 1516	2220	da375a209987a2c6b866cc6c15335c844b3bc0666b20ea0df73b8a68a0879f02.exe	28
PID 2220 wrote to memory of 1516	2220	da375a209987a2c6b866cc6c15335c844b3bc0666b20ea0df73b8a68a0879f02.exe	28
PID 2220 wrote to memory of 1516	2220	da375a209987a2c6b866cc6c15335c844b3bc0666b20ea0df73b8a68a0879f02.exe	28

C:\Users\Admin\AppData\Local\Temp\da375a209987a2c6b866cc6c15335c844b3bc0666b20ea0df73b8a68a0879f02.exe
"C:\Users\Admin\AppData\Local\Temp\da375a209987a2c6b866cc6c15335c844b3bc0666b20ea0df73b8a68a0879f02.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso5FDD.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
56KB

MD5
55a6857983149c900d6d6b8044545968

SHA1
7ca1a8b9ded8fa8f30ba7c45166f7d08f724a22e

SHA256
da375a209987a2c6b866cc6c15335c844b3bc0666b20ea0df73b8a68a0879f02

SHA512
927308bc80afea2e59787bea8144ccc3188dd5562418dbce004ad5a719de022700a8812de52f0aa206deef6ac1a7c36a85dfc10a543f87f1103df5e73790f96e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
56KB

MD5
55a6857983149c900d6d6b8044545968

SHA1
7ca1a8b9ded8fa8f30ba7c45166f7d08f724a22e

SHA256
da375a209987a2c6b866cc6c15335c844b3bc0666b20ea0df73b8a68a0879f02

SHA512
927308bc80afea2e59787bea8144ccc3188dd5562418dbce004ad5a719de022700a8812de52f0aa206deef6ac1a7c36a85dfc10a543f87f1103df5e73790f96e

Download Submit
\Users\Admin\AppData\Local\Temp\nso5FDD.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
56KB

MD5
55a6857983149c900d6d6b8044545968

SHA1
7ca1a8b9ded8fa8f30ba7c45166f7d08f724a22e

SHA256
da375a209987a2c6b866cc6c15335c844b3bc0666b20ea0df73b8a68a0879f02

SHA512
927308bc80afea2e59787bea8144ccc3188dd5562418dbce004ad5a719de022700a8812de52f0aa206deef6ac1a7c36a85dfc10a543f87f1103df5e73790f96e

Download Submit