a5261150295a75eb2d6b2901531dac158f80bc4372d7f8b4ca3043bf20ae6598

Analysis

max time kernel
182s
max time network
250s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
26/11/2023, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5261150295a75eb2d6b2901531dac158f80bc4372d7f8b4ca3043bf20ae6598.exe
Size 1.6MB
Sample231126-2fqb8scg38
SHA256 a5261150295a75eb2d6b2901531dac158f80bc4372d7f8b4ca3043bf20ae6598
MD5 a3502faa68837c00b72aa922810c8928
SHA1 6279bc8d920f5958b229999dc157f82c9e9d6643
SHA512 a04ff971df2eed3c3f8feda26a4db9d485cf9335efa43b14c65cd2f3dc797a899f20428e69d747486aa5bfdaee7a119812c1b5f3e561fb8698df8d4a4316efb6
SSDEEP 49152:cYbFm+Ut9OPU/D5KvGpJCck5+e0+sRkQ7DyQx5IpaSGAQ:cYZsDAep8P+n9kQ7Db5IpaSxQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
220	rundll32.exe
2276	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 2312	4200	a5261150295a75eb2d6b2901531dac158f80bc4372d7f8b4ca3043bf20ae6598.exe	71
PID 4200 wrote to memory of 2312	4200	a5261150295a75eb2d6b2901531dac158f80bc4372d7f8b4ca3043bf20ae6598.exe	71
PID 4200 wrote to memory of 2312	4200	a5261150295a75eb2d6b2901531dac158f80bc4372d7f8b4ca3043bf20ae6598.exe	71
PID 2312 wrote to memory of 4684	2312	cmd.exe	74
PID 2312 wrote to memory of 4684	2312	cmd.exe	74
PID 2312 wrote to memory of 4684	2312	cmd.exe	74
PID 4684 wrote to memory of 220	4684	control.exe	75
PID 4684 wrote to memory of 220	4684	control.exe	75
PID 4684 wrote to memory of 220	4684	control.exe	75
PID 220 wrote to memory of 1268	220	rundll32.exe	76
PID 220 wrote to memory of 1268	220	rundll32.exe	76
PID 1268 wrote to memory of 2276	1268	RunDll32.exe	77
PID 1268 wrote to memory of 2276	1268	RunDll32.exe	77
PID 1268 wrote to memory of 2276	1268	RunDll32.exe	77

C:\Users\Admin\AppData\Local\Temp\a5261150295a75eb2d6b2901531dac158f80bc4372d7f8b4ca3043bf20ae6598.exe
"C:\Users\Admin\AppData\Local\Temp\a5261150295a75eb2d6b2901531dac158f80bc4372d7f8b4ca3043bf20ae6598.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z7E659068\1bp6.Bat" "
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\7z7E659068\X94EKAV.Cpl",
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z7E659068\X94EKAV.Cpl",
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:220
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z7E659068\X94EKAV.Cpl",
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1268
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7z7E659068\X94EKAV.Cpl",
        6⤵
        Loads dropped DLL
        
        PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1bp6.Bat

Path C:\Users\Admin\AppData\Local\Temp\7z7E659068\1bp6.Bat
Size 54B
SHA256 7d679bed3d02b1022442379da9508097bb76aa285f2fce023fd7925224c3ec27
MD5 6278bdbc6d5e94ff1ef134fe59e32823
SHA1 d284f8b138cdae232503b2d8db0ed595ebc5ccd0
SHA512 5b446b4c3b98df42d6d946f6d48d0c90efafb817eb08682be5ed3020a175bb6915e26a410109a675d60965fcb4c951469ad7b4e82106568b718916e49bc613b2
MD5 SHA1 SHA512

Submit Download

X94EKAV.Cpl

Path C:\Users\Admin\AppData\Local\Temp\7z7E659068\X94EKAV.Cpl
Size 1.8MB
SHA256 b6fb30e7feeb6d72e51480e536ea2b241b3f08edb80231218864219522ce3391
MD5 1f5cb9e3de17257570a8c538c346fad1
SHA1 58fc43213555bea4e73bcaee5d6a0a4a3157eedf
SHA512 776da593815db0fc2a724f9e49b731d340b141cb7422832e3319d895e974f64e3c4e4844045c73b9efa4bee3976f5e8ea59aa8e40e60356917cf8838fe30f28d
SSDEEP 49152:CxklSaw/Gp3q+D36klxp15aYxFhe0hqPE:Cesa4SVbZ3DQK
MD5 SHA1 SHA512 SSDEEP

Submit Download

X94EKAV.Cpl

Path \Users\Admin\AppData\Local\Temp\7z7E659068\X94EKAV.Cpl
Size 1.8MB
SHA256 b6fb30e7feeb6d72e51480e536ea2b241b3f08edb80231218864219522ce3391
MD5 1f5cb9e3de17257570a8c538c346fad1
SHA1 58fc43213555bea4e73bcaee5d6a0a4a3157eedf
SHA512 776da593815db0fc2a724f9e49b731d340b141cb7422832e3319d895e974f64e3c4e4844045c73b9efa4bee3976f5e8ea59aa8e40e60356917cf8838fe30f28d
SSDEEP 49152:CxklSaw/Gp3q+D36klxp15aYxFhe0hqPE:Cesa4SVbZ3DQK
MD5 SHA1 SHA512 SSDEEP

Submit Download

X94EKAV.Cpl

Path \Users\Admin\AppData\Local\Temp\7z7E659068\X94EKAV.Cpl
Size 1.8MB
SHA256 b6fb30e7feeb6d72e51480e536ea2b241b3f08edb80231218864219522ce3391
MD5 1f5cb9e3de17257570a8c538c346fad1
SHA1 58fc43213555bea4e73bcaee5d6a0a4a3157eedf
SHA512 776da593815db0fc2a724f9e49b731d340b141cb7422832e3319d895e974f64e3c4e4844045c73b9efa4bee3976f5e8ea59aa8e40e60356917cf8838fe30f28d
SSDEEP 49152:CxklSaw/Gp3q+D36klxp15aYxFhe0hqPE:Cesa4SVbZ3DQK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-16-0x0000000004CE0000-0x0000000004DEB000-memory.dmp

Download

memory/220-12-0x0000000004BB0000-0x0000000004CD7000-memory.dmp

Download

memory/220-13-0x0000000004CE0000-0x0000000004DEB000-memory.dmp

Download

memory/220-14-0x0000000004CE0000-0x0000000004DEB000-memory.dmp

Download

memory/220-10-0x0000000010000000-0x00000000101D3000-memory.dmp

Download

memory/220-17-0x0000000004CE0000-0x0000000004DEB000-memory.dmp

Download

memory/220-9-0x0000000002A60000-0x0000000002A66000-memory.dmp

Download

memory/2276-19-0x0000000003630000-0x0000000003636000-memory.dmp

Download

memory/2276-22-0x0000000005540000-0x0000000005667000-memory.dmp

Download

memory/2276-24-0x0000000005670000-0x000000000577B000-memory.dmp

Download

memory/2276-26-0x0000000005670000-0x000000000577B000-memory.dmp

Download

memory/2276-27-0x0000000005670000-0x000000000577B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads