5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad

Analysis

max time kernel
153s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe
Size

12.2MB
MD5

4b747f4588c3c68f97c07fee14ea71e4
SHA1

84a7920826587f13c8b55aaf6a8cad3149e9b811
SHA256

5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad
SHA512

131d336dc4cdd5a11b42288004e841780a72c9ced0c6cbdfd00ecf053e5533f28f3a1082297916ff4b9975626388ce808ed0bbfd67d9291ef0ece4e85e3718d2
SSDEEP

393216:Jf/gleEaUfJ75EMMtt3sOa1cSqdPFRQ/d/Bg/dA:V/XGMtKOa189I/d/yi

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4728	5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe
4728	5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe
4728	5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe
4728	5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 2404	4728	5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe	85
PID 4728 wrote to memory of 2404	4728	5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe	85
PID 4728 wrote to memory of 2404	4728	5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe	85
PID 4728 wrote to memory of 4552	4728	5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe	86
PID 4728 wrote to memory of 4552	4728	5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe	86
PID 4728 wrote to memory of 4552	4728	5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe	86

C:\Users\Admin\AppData\Local\Temp\5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe
"C:\Users\Admin\AppData\Local\Temp\5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exe"
  2⤵
  PID:2404
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"
  2⤵
  PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5e9d2ac9ff178ca9f53307868a39aaf6b6f48203023f848b45baae449b4243ad.exepack.tmp

Filesize
2KB

MD5
8b52bb8e4b5cc2f54d13fdf7451c70ab

SHA1
c9f621b2fcc4f54a744b9944198c389c7b410bbf

SHA256
d39cc4189d8a6ac3a62de4fcc8a0cbf6f39541717e41faa242adbf32679e9b7e

SHA512
c6ae68f27417d12acdddfcfcd42ea9ba35cc3ea64f20d0a15decca4fe16bb7473ea8c4f55fea96e584fcf5f1425ae2046afd9d7646ed69334c88337b523cd9f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\6f1410fc67376db2575b8f356a16a476.ini

Filesize
1KB

MD5
c945121aa5581c2c1a1051b824949550

SHA1
2c3a3aa70099d82bcb3d185d84e6d8390563ad74

SHA256
2bcfa925bad73e588d83bca77108b9a73ec781de6b5b73f6658f9e21ebc5bf30

SHA512
65c6f9ef541c984a9ae83f0f2a88281881d690249a69bd1813338d95e6611eb5b610d3315910c445c1eefd4d645553b8e5fbf5e247909acb4765aba3274b717d

Download Submit
C:\Users\Admin\AppData\Local\Temp\6f1410fc67376db2575b8f356a16a476A.ini

Filesize
1KB

MD5
2f256b74893dcfd095063dbfc9f3e606

SHA1
48a3816ba3713e223973a2ecfe4fc5f9455f4d6f

SHA256
e37a80a2b2a35c77da46372b4d7029cc533bb8d1d3bc454fa4603a3941e4cefc

SHA512
8b2513f6a019b64801d8aba5189dc8f5a65a742b3eb5d4d9fc108722430e5ca60272ed19fd528c2e5c61c9d6df2d8074d312933b8a0404e7fc3779a48eb04a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\D3DX81ab.dll

Filesize
664KB

MD5
96831db43a5e23cd897e2908ad4879f4

SHA1
d2ab0e4f38d5ca00a4b057b05b9c4ae86e50582c

SHA256
00e100a10c3413090951b0e66739d071cf79b8b9337afef5d675874bc68c3f02

SHA512
f4f9ccd6fe1a767160eaa7c0a86db102769211ae89d5da9a3851f75c01deb457ed94d9be366969709d73f21e94df52880f1d72f5ff3bf96f69e0b2c6bd2b017e

Download Submit
memory/4728-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/4728-0-0x0000000000400000-0x0000000001F2B000-memory.dmp

Filesize
27.2MB

Download
memory/4728-2-0x0000000000400000-0x0000000001F2B000-memory.dmp

Filesize
27.2MB

Download
memory/4728-318-0x0000000000400000-0x0000000001F2B000-memory.dmp

Filesize
27.2MB

Download
memory/4728-1-0x0000000002080000-0x0000000002083000-memory.dmp

Filesize
12KB

Download
memory/4728-334-0x0000000002080000-0x0000000002083000-memory.dmp

Filesize
12KB

Download
memory/4728-335-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/4728-338-0x0000000000400000-0x0000000001F2B000-memory.dmp

Filesize
27.2MB

Download
memory/4728-343-0x0000000000400000-0x0000000001F2B000-memory.dmp

Filesize
27.2MB

Download
memory/4728-359-0x0000000000400000-0x0000000001F2B000-memory.dmp

Filesize
27.2MB

Download