b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe
Size

11.3MB
MD5

bba9f453dcbacebb514bc633c1a62841
SHA1

81f58e3571f2aa2afac8fe1ffd4005a7bdc0bb8a
SHA256

b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504
SHA512

f25c080efca85ef2431332b7134b350424557044a48d4cb7f3a231b1d054860f6daf8fe1e9a9eb18fe2213beb4069c513fe2b81ecd74f1f710086317b88614dd
SSDEEP

196608:67wCgMw5S+3vM11Nolsono9t2Ar28q/3fq5hgpDtzjbF7vPj798dZrtdr3u:Ow5T3E11ai2AK8q/3fpvBjj72ZtdTu

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4960	b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe
4960	b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe
4960	b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe
4960	b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 1936	4960	b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe	88
PID 4960 wrote to memory of 1936	4960	b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe	88
PID 4960 wrote to memory of 1936	4960	b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe	88
PID 4960 wrote to memory of 1324	4960	b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe	89
PID 4960 wrote to memory of 1324	4960	b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe	89
PID 4960 wrote to memory of 1324	4960	b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe	89

C:\Users\Admin\AppData\Local\Temp\b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe
"C:\Users\Admin\AppData\Local\Temp\b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*adeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exe"
  2⤵
  PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"
  2⤵
  PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\569267de99575e28b25ac4cc3d057c85.ini

Filesize
1KB

MD5
b2c3747a35e7dfbc1c650c3711bcb42c

SHA1
09e9db927c60f6c406f843b409f915e7bcac06f3

SHA256
75455e60675e12a43a64df6903479b8874f72c2ef577ed182d7843b520e49fda

SHA512
e346553121fe04f78a26bdbff937a94ae64c53805237e04178a2ad2aa70f7f12c34f13e75dfde62bb6fcd01f9464c822c185e66aa2711e5dd1d83749a03cb00a

Download Submit
C:\Users\Admin\AppData\Local\Temp\569267de99575e28b25ac4cc3d057c85A.ini

Filesize
1KB

MD5
8865ffb6ec678c6bf10ed2588d3715e7

SHA1
e3dc9cb3e28a3f640ac2d5c94d73d6a934d94e8d

SHA256
6c5790a9d88fedf2bc0073f9ba0887aef6882b2d063669d64d2bdfd39c907a7b

SHA512
7edfad31e71b15d8eb2b71f63fdd8c59beea31302cc9f06643f3e4bef8bfb9de20ae777b0d0f5f6b8c87ec6a18be44fd90f0702dddc84d87bb6c8e48a4bd41d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8fadeb328f81a045c6ee83fac2ae7a8256ed2bf4d5ed80636efa3b5d3e26504.exepack.tmp

Filesize
2KB

MD5
75f1afaf539858702060441ef80ece49

SHA1
1b287052f5d92afac51fd894647bd11a0011c66e

SHA256
315100335c9e5c17856ed37eda609f359b3e82ada225286764d0a5e8f0e38e07

SHA512
67bd5054a69315fbc093fccb3caf1ad69fdc04a48f413feed77d22798856e1b6fec0cc2e85b0cda975465c30d3181f0eff567962f4c85d594cc284221e8cfb92

Download Submit
memory/4960-0-0x0000000000400000-0x0000000001EEF000-memory.dmp

Filesize
26.9MB

Download
memory/4960-1-0x0000000002080000-0x0000000002083000-memory.dmp

Filesize
12KB

Download
memory/4960-2-0x0000000000400000-0x0000000001EEF000-memory.dmp

Filesize
26.9MB

Download
memory/4960-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/4960-94-0x0000000000400000-0x0000000001EEF000-memory.dmp

Filesize
26.9MB

Download
memory/4960-95-0x0000000002080000-0x0000000002083000-memory.dmp

Filesize
12KB

Download
memory/4960-340-0x0000000000400000-0x0000000001EEF000-memory.dmp

Filesize
26.9MB

Download
memory/4960-342-0x0000000000400000-0x0000000001EEF000-memory.dmp

Filesize
26.9MB

Download