Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 19:07
Static task
static1
Behavioral task
behavioral1
Sample
198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe
Resource
win10v2004-20230915-en
General
-
Target
198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe
-
Size
2.7MB
-
MD5
dc498ddf3ba67a02d9f839885ec55d0b
-
SHA1
4c6e1bdd63b9e9f3cc53627ddc30f8e5aaafd1d4
-
SHA256
198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf
-
SHA512
c70bb21c7e405582191b67e213489668467c0bf0279e2391ba0bfab23b6eab5cfd4aabfa97e306b254fcc0ae799dc1f25052cbf25e1a8883c90d38603386f485
-
SSDEEP
49152:acbz6GzJT8USgT/eFOn7EuTEBQ1wP9p0xxOSJfd4RwrkimJtZElBBuIT:acb7zh8uWwri0Pxx/JFdrki4taA4
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2100 regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2100 2248 198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe 28 PID 2248 wrote to memory of 2100 2248 198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe 28 PID 2248 wrote to memory of 2100 2248 198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe 28 PID 2248 wrote to memory of 2100 2248 198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe 28 PID 2248 wrote to memory of 2100 2248 198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe 28 PID 2248 wrote to memory of 2100 2248 198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe 28 PID 2248 wrote to memory of 2100 2248 198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe"C:\Users\Admin\AppData\Local\Temp\198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -u -S .\8N7E.CH2⤵
- Loads dropped DLL
PID:2100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD51333d4e84666132c9924df4d6427cf5d
SHA1967574535a4950b68e6904dbb978c5e5dbf4428a
SHA256825cb4d78950bacae560ea1b2d81c33e9aacfa4651c4ccef376bb1afcba21e59
SHA5122e456aeaa25ebdea682149a6f75acadfb429a9ccc6a60c2a1a54d4429d0157789009c0097ffbc0f2a62b753bbc56b49acd86e383f1fe076dc9cfbb34ad2b9f95
-
Filesize
2.7MB
MD51333d4e84666132c9924df4d6427cf5d
SHA1967574535a4950b68e6904dbb978c5e5dbf4428a
SHA256825cb4d78950bacae560ea1b2d81c33e9aacfa4651c4ccef376bb1afcba21e59
SHA5122e456aeaa25ebdea682149a6f75acadfb429a9ccc6a60c2a1a54d4429d0157789009c0097ffbc0f2a62b753bbc56b49acd86e383f1fe076dc9cfbb34ad2b9f95