Analysis
-
max time kernel
146s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe
Resource
win10v2004-20230915-en
General
-
Target
57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe
-
Size
2.8MB
-
MD5
a59c5cfff822ca337569eb73f9b33d02
-
SHA1
5df611f1f8e328c14c10ccd80818cc6d80891256
-
SHA256
57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f
-
SHA512
b021a1832f90b3a4d8e8187d2d9e5d6bdb8661cd9c4eab67248cf8f3c9a9a012b79b255eec38eb16a3675792bfd3026ffd9a5b8071f3d9bfac6c40ad76858861
-
SSDEEP
49152:zGFjrscUfO7otry1+K0ZLLyVvP1B94iJqoP8tsUM05:qFjrwfxZd2lBFjysUd5
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2764 is-4VB40.tmp 2600 OSJMount.exe 2984 OSJMount.exe -
Loads dropped DLL 5 IoCs
pid Process 2228 57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe 2764 is-4VB40.tmp 2764 is-4VB40.tmp 2764 is-4VB40.tmp 2764 is-4VB40.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\OSJMount\OSJMount.exe is-4VB40.tmp File created C:\Program Files (x86)\OSJMount\is-MV145.tmp is-4VB40.tmp File created C:\Program Files (x86)\OSJMount\is-FSCCO.tmp is-4VB40.tmp File created C:\Program Files (x86)\OSJMount\is-P6IGT.tmp is-4VB40.tmp File created C:\Program Files (x86)\OSJMount\is-9LFIV.tmp is-4VB40.tmp File created C:\Program Files (x86)\OSJMount\unins000.dat is-4VB40.tmp File created C:\Program Files (x86)\OSJMount\is-OK249.tmp is-4VB40.tmp File created C:\Program Files (x86)\OSJMount\is-T0DB5.tmp is-4VB40.tmp File opened for modification C:\Program Files (x86)\OSJMount\unins000.dat is-4VB40.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2764 2228 57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe 28 PID 2228 wrote to memory of 2764 2228 57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe 28 PID 2228 wrote to memory of 2764 2228 57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe 28 PID 2228 wrote to memory of 2764 2228 57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe 28 PID 2228 wrote to memory of 2764 2228 57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe 28 PID 2228 wrote to memory of 2764 2228 57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe 28 PID 2228 wrote to memory of 2764 2228 57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe 28 PID 2764 wrote to memory of 2512 2764 is-4VB40.tmp 31 PID 2764 wrote to memory of 2512 2764 is-4VB40.tmp 31 PID 2764 wrote to memory of 2512 2764 is-4VB40.tmp 31 PID 2764 wrote to memory of 2512 2764 is-4VB40.tmp 31 PID 2764 wrote to memory of 2600 2764 is-4VB40.tmp 33 PID 2764 wrote to memory of 2600 2764 is-4VB40.tmp 33 PID 2764 wrote to memory of 2600 2764 is-4VB40.tmp 33 PID 2764 wrote to memory of 2600 2764 is-4VB40.tmp 33 PID 2512 wrote to memory of 2564 2512 net.exe 34 PID 2512 wrote to memory of 2564 2512 net.exe 34 PID 2512 wrote to memory of 2564 2512 net.exe 34 PID 2512 wrote to memory of 2564 2512 net.exe 34 PID 2764 wrote to memory of 2984 2764 is-4VB40.tmp 35 PID 2764 wrote to memory of 2984 2764 is-4VB40.tmp 35 PID 2764 wrote to memory of 2984 2764 is-4VB40.tmp 35 PID 2764 wrote to memory of 2984 2764 is-4VB40.tmp 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe"C:\Users\Admin\AppData\Local\Temp\57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\is-VQV34.tmp\is-4VB40.tmp"C:\Users\Admin\AppData\Local\Temp\is-VQV34.tmp\is-4VB40.tmp" /SL4 $70122 "C:\Users\Admin\AppData\Local\Temp\57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe" 2672038 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 273⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 274⤵PID:2564
-
-
-
C:\Program Files (x86)\OSJMount\OSJMount.exe"C:\Program Files (x86)\OSJMount\OSJMount.exe" -i3⤵
- Executes dropped EXE
PID:2600
-
-
C:\Program Files (x86)\OSJMount\OSJMount.exe"C:\Program Files (x86)\OSJMount\OSJMount.exe" -s3⤵
- Executes dropped EXE
PID:2984
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD55912bbcdfa36233362763a4060ced585
SHA155be4167661d442b499ed9c5859b20b03538a348
SHA2566a2ae59fd216c959c32afd32c291b5127a820ad50f46df15985d7b9e3d1ef1c6
SHA512c6e50d0003dcdd16c815861053279067da0bb5dc9f6b7430c3eb0a7865d5b5416de295e83c2c0a1c862c7d6f956ca37c99db030fff092dec32d8974120969e86
-
Filesize
2.0MB
MD55912bbcdfa36233362763a4060ced585
SHA155be4167661d442b499ed9c5859b20b03538a348
SHA2566a2ae59fd216c959c32afd32c291b5127a820ad50f46df15985d7b9e3d1ef1c6
SHA512c6e50d0003dcdd16c815861053279067da0bb5dc9f6b7430c3eb0a7865d5b5416de295e83c2c0a1c862c7d6f956ca37c99db030fff092dec32d8974120969e86
-
Filesize
2.0MB
MD55912bbcdfa36233362763a4060ced585
SHA155be4167661d442b499ed9c5859b20b03538a348
SHA2566a2ae59fd216c959c32afd32c291b5127a820ad50f46df15985d7b9e3d1ef1c6
SHA512c6e50d0003dcdd16c815861053279067da0bb5dc9f6b7430c3eb0a7865d5b5416de295e83c2c0a1c862c7d6f956ca37c99db030fff092dec32d8974120969e86
-
Filesize
652KB
MD5f1b5055e1e80bf52a48683f85f9298ef
SHA126976cc0c690693084466d185c5e84da9870a778
SHA2560b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50
SHA51201290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef
-
Filesize
652KB
MD5f1b5055e1e80bf52a48683f85f9298ef
SHA126976cc0c690693084466d185c5e84da9870a778
SHA2560b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50
SHA51201290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef
-
Filesize
2.0MB
MD55912bbcdfa36233362763a4060ced585
SHA155be4167661d442b499ed9c5859b20b03538a348
SHA2566a2ae59fd216c959c32afd32c291b5127a820ad50f46df15985d7b9e3d1ef1c6
SHA512c6e50d0003dcdd16c815861053279067da0bb5dc9f6b7430c3eb0a7865d5b5416de295e83c2c0a1c862c7d6f956ca37c99db030fff092dec32d8974120969e86
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
652KB
MD5f1b5055e1e80bf52a48683f85f9298ef
SHA126976cc0c690693084466d185c5e84da9870a778
SHA2560b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50
SHA51201290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef