5ff7b17e40d788280131a1a80bd0dc7450b8d4af120a08a0e3904b1e92cae5f4

Resubmissions

22/10/2023, 21:32

231022-1dvy9scg9s 7

22/10/2023, 21:29

231022-1b69hscg8v 7

Analysis

max time kernel
70s
max time network
19s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R2R/ISM_KeyGen.exe
Size

459KB
MD5

2c4ce8113bff962e68c60c8137574439
SHA1

465ad0867d3532fd42544a685425caf071469497
SHA256

f92846f75988ae8272f66dc45456e1b79ab072269a13301da974ad3f40ec4676
SHA512

66af9a11022eeb8911e78473121b5db1bc3c6e49f8e8bcdc02ff2509b115151757d6ad36c85296a175a1b9f6f930c90cd69407e409ed136bcbefda7cf84f86f9
SSDEEP

6144:iay2nA8P9tlASRzKW3kj6sfgq/ocftDN4HuIYq9gAFqLvEGH7xNj9dt+lKlozS:sc9t2SllUDj/oc+KqKjvJdGKuS

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1440	keygen.exe

Loads dropped DLL 4 IoCs

pid	Process
2252	ISM_KeyGen.exe
2252	ISM_KeyGen.exe
1440	keygen.exe
1440	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1440	2252	ISM_KeyGen.exe	28
PID 2252 wrote to memory of 1440	2252	ISM_KeyGen.exe	28
PID 2252 wrote to memory of 1440	2252	ISM_KeyGen.exe	28
PID 2252 wrote to memory of 1440	2252	ISM_KeyGen.exe	28

C:\Users\Admin\AppData\Local\Temp\R2R\ISM_KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\R2R\ISM_KeyGen.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
C:\Users\Admin\AppData\Local\Temp\R2RISMKG.dll

Filesize
3KB

MD5
9e76df9b1a539a044d721558bce7e0ba

SHA1
a3a562de62a1acab6788c8673d3103812cbde5e5

SHA256
a0e80bfdeb729f9caab732a887f1bf9b5521d5e2192bc327f8c2fe72b74da18e

SHA512
1c34f5f80b32877173457259b89fda3d82230a56997a218cebd1ebf37a679e18393a562ef0dba4305b61e943a0ae20cef5b6645b21f199d0574e3d8128a98891

Download Submit
C:\Users\Admin\AppData\Local\Temp\bgm.xm

Filesize
30KB

MD5
c5cd5f983a2878408f80f18c383163f4

SHA1
fcf00e65b1115ec33cb95280e79bdfc670db2d65

SHA256
17c1b667189f9b4451d1fc129386f7fecab1bbf9ccd591c3bfe25e5337800570

SHA512
ce4f899b2b6a3349cd73708701481b3a7f69074ff254883f4176904894b25b721b01678d969c803dae0ac84acf72e5df718facf8bf370e34e09ee4f480c23594

Download Submit
C:\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
544KB

MD5
18311c388fa3e2f261256264273f1ed9

SHA1
1502bc3ad516d840502dfa4b787f00dd71ddca53

SHA256
e05f5442ce9604cd23fca43bd40385958e1f0587582c72a5b3a09cfad49a0e9a

SHA512
700c1dc36fcf76dc1a9cd74fbe1cd4a84f4b33f4587e7a63ac43688befc4c48a3c222b4e1e629b10507e9813a9d103b11ba7dc96be2cba748d257fbf886fd901

Download Submit
C:\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
544KB

MD5
18311c388fa3e2f261256264273f1ed9

SHA1
1502bc3ad516d840502dfa4b787f00dd71ddca53

SHA256
e05f5442ce9604cd23fca43bd40385958e1f0587582c72a5b3a09cfad49a0e9a

SHA512
700c1dc36fcf76dc1a9cd74fbe1cd4a84f4b33f4587e7a63ac43688befc4c48a3c222b4e1e629b10507e9813a9d103b11ba7dc96be2cba748d257fbf886fd901

Download Submit
C:\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
544KB

MD5
18311c388fa3e2f261256264273f1ed9

SHA1
1502bc3ad516d840502dfa4b787f00dd71ddca53

SHA256
e05f5442ce9604cd23fca43bd40385958e1f0587582c72a5b3a09cfad49a0e9a

SHA512
700c1dc36fcf76dc1a9cd74fbe1cd4a84f4b33f4587e7a63ac43688befc4c48a3c222b4e1e629b10507e9813a9d103b11ba7dc96be2cba748d257fbf886fd901

Download Submit
\Users\Admin\AppData\Local\Temp\BASSMOD.dll

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
\Users\Admin\AppData\Local\Temp\R2RISMKG.dll

Filesize
3KB

MD5
9e76df9b1a539a044d721558bce7e0ba

SHA1
a3a562de62a1acab6788c8673d3103812cbde5e5

SHA256
a0e80bfdeb729f9caab732a887f1bf9b5521d5e2192bc327f8c2fe72b74da18e

SHA512
1c34f5f80b32877173457259b89fda3d82230a56997a218cebd1ebf37a679e18393a562ef0dba4305b61e943a0ae20cef5b6645b21f199d0574e3d8128a98891

Download Submit
\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
544KB

MD5
18311c388fa3e2f261256264273f1ed9

SHA1
1502bc3ad516d840502dfa4b787f00dd71ddca53

SHA256
e05f5442ce9604cd23fca43bd40385958e1f0587582c72a5b3a09cfad49a0e9a

SHA512
700c1dc36fcf76dc1a9cd74fbe1cd4a84f4b33f4587e7a63ac43688befc4c48a3c222b4e1e629b10507e9813a9d103b11ba7dc96be2cba748d257fbf886fd901

Download Submit
\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
544KB

MD5
18311c388fa3e2f261256264273f1ed9

SHA1
1502bc3ad516d840502dfa4b787f00dd71ddca53

SHA256
e05f5442ce9604cd23fca43bd40385958e1f0587582c72a5b3a09cfad49a0e9a

SHA512
700c1dc36fcf76dc1a9cd74fbe1cd4a84f4b33f4587e7a63ac43688befc4c48a3c222b4e1e629b10507e9813a9d103b11ba7dc96be2cba748d257fbf886fd901

Download Submit
memory/1440-15-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1440-18-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1440-19-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1440-20-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1440-21-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1440-22-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1440-23-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1440-24-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1440-25-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download