Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12-10-2023 19:07

General

  • Target

    198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe

  • Size

    2.7MB

  • MD5

    dc498ddf3ba67a02d9f839885ec55d0b

  • SHA1

    4c6e1bdd63b9e9f3cc53627ddc30f8e5aaafd1d4

  • SHA256

    198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf

  • SHA512

    c70bb21c7e405582191b67e213489668467c0bf0279e2391ba0bfab23b6eab5cfd4aabfa97e306b254fcc0ae799dc1f25052cbf25e1a8883c90d38603386f485

  • SSDEEP

    49152:acbz6GzJT8USgT/eFOn7EuTEBQ1wP9p0xxOSJfd4RwrkimJtZElBBuIT:acb7zh8uWwri0Pxx/JFdrki4taA4

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe
    "C:\Users\Admin\AppData\Local\Temp\198641c6e206828834b441764ad24e61d595d95aff366dbacc74919d936390bf.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -u -S .\8N7E.CH
      2⤵
      • Loads dropped DLL
      PID:2100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8N7E.CH

    Filesize

    2.7MB

    MD5

    1333d4e84666132c9924df4d6427cf5d

    SHA1

    967574535a4950b68e6904dbb978c5e5dbf4428a

    SHA256

    825cb4d78950bacae560ea1b2d81c33e9aacfa4651c4ccef376bb1afcba21e59

    SHA512

    2e456aeaa25ebdea682149a6f75acadfb429a9ccc6a60c2a1a54d4429d0157789009c0097ffbc0f2a62b753bbc56b49acd86e383f1fe076dc9cfbb34ad2b9f95

  • \Users\Admin\AppData\Local\Temp\8N7E.ch

    Filesize

    2.7MB

    MD5

    1333d4e84666132c9924df4d6427cf5d

    SHA1

    967574535a4950b68e6904dbb978c5e5dbf4428a

    SHA256

    825cb4d78950bacae560ea1b2d81c33e9aacfa4651c4ccef376bb1afcba21e59

    SHA512

    2e456aeaa25ebdea682149a6f75acadfb429a9ccc6a60c2a1a54d4429d0157789009c0097ffbc0f2a62b753bbc56b49acd86e383f1fe076dc9cfbb34ad2b9f95

  • memory/2100-5-0x0000000000170000-0x0000000000176000-memory.dmp

    Filesize

    24KB

  • memory/2100-4-0x0000000010000000-0x00000000102B7000-memory.dmp

    Filesize

    2.7MB

  • memory/2100-7-0x0000000000E90000-0x0000000000F8D000-memory.dmp

    Filesize

    1012KB

  • memory/2100-8-0x00000000023C0000-0x00000000024A5000-memory.dmp

    Filesize

    916KB

  • memory/2100-11-0x00000000023C0000-0x00000000024A5000-memory.dmp

    Filesize

    916KB

  • memory/2100-12-0x00000000023C0000-0x00000000024A5000-memory.dmp

    Filesize

    916KB