65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435

Analysis

max time kernel
186s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe
Size

15.1MB
MD5

9844bb45006611bdee92b71e92c8b3dd
SHA1

0866585cbdd0acb55eba6aa2736aed630b525089
SHA256

65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435
SHA512

d931968080e024d4235cfdffa620cf09a6cf6dabb4ad7420292422c8b39132e16273615bacd545ed30cb6a99edb8327894517191c740ff44d5f24570eee8195f
SSDEEP

393216:SljBptm3gmaVt3WwUxAd3YWxWIXrzwQXG+jhKRKYEjx8U9XV+N:ojBptmgm1wtVpnRNYEjxaN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4420	65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe
4420	65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe
4420	65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe
4420	65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 8	4420	65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe	99
PID 4420 wrote to memory of 8	4420	65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe	99
PID 4420 wrote to memory of 8	4420	65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe	99
PID 4420 wrote to memory of 1964	4420	65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe	100
PID 4420 wrote to memory of 1964	4420	65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe	100
PID 4420 wrote to memory of 1964	4420	65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe	100

C:\Users\Admin\AppData\Local\Temp\65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe
"C:\Users\Admin\AppData\Local\Temp\65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exe"
  2⤵
  PID:8
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"
  2⤵
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\65e47cfde8e5dd09433f2da6ae48dabe696c4988b808ebf7900502c57ee1f435.exepack.tmp

Filesize
2KB

MD5
e5b0f1fdcd69897ccda59c952b4235ee

SHA1
18952e8e1c82eaf3ac96e1b88ddffde328839119

SHA256
e9fbdaa8393eb0a4583193c02487227465918d958d2f8dbe847808e4f417448d

SHA512
6b8b43dce89ffd07b43baa6c30358fa614b4281df22407b3c2598fa6f658c53e51957d683829487e6b54dad35c973fa33b80dd3cdeaafc11463643934199e96b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7638c6d0de1b79040932ed42df623a4f.ini

Filesize
1KB

MD5
b5ce7d643b623aead7c35dfce0549059

SHA1
3dd2ecba5ed0e70b7aa1270aacdaef07357a0259

SHA256
0d09eac512a03b57eabc013eb6ca6316bf02c9d4ab4ae3d1c196eedfae2da06a

SHA512
00ff32e7842704e7fd4eaa5620ec6f558bf7d3f1d3301a8851bf0944a98e218b691331ee30a82745b4300b7741d7bb7f92e19b385413533f145fbdf8e9db2cd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7638c6d0de1b79040932ed42df623a4fA.ini

Filesize
1KB

MD5
f5d8edd0b8b030d6baf6326ad2f9c9c0

SHA1
d2d3a0f00f06a5e7ed089d3cbbd712047dae893e

SHA256
282c902f721e0dcd2c96215104d6a9f8ab25517d8011ca04ab8a3873d8d45ccf

SHA512
8d3b6c823ffcdfb2ff8ad8cb11d22882203875cfc930b47a846916e32e925204d18f6f179b5914f9ef1e373baa70f4cd8aa061ef331cea3cd7c79a77dee10649

Download Submit
memory/4420-7-0x0000000001FB0000-0x0000000001FB3000-memory.dmp

Filesize
12KB

Download
memory/4420-321-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/4420-0-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/4420-8-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/4420-9-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/4420-11-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/4420-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/4420-2-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/4420-1-0x0000000001FB0000-0x0000000001FB3000-memory.dmp

Filesize
12KB

Download
memory/4420-6-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/4420-324-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/4420-337-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/4420-338-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/4420-341-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/4420-343-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/4420-344-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download
memory/4420-346-0x0000000000400000-0x0000000001DCC000-memory.dmp

Filesize
25.8MB

Download