f35031dad7ad42ea6ea2fa3759b9d30f25d2f2c538bb41b7a141882bccad7016

Analysis

max time kernel
92s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2023 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f35031dad7ad42ea6ea2fa3759b9d30f25d2f2c538bb41b7a141882bccad7016.exe
Size

588KB
MD5

1798698abf363fd83df2ee7c88591afd
SHA1

c8fb4e10db9391ba47c48cc290b48b79d0913b32
SHA256

f35031dad7ad42ea6ea2fa3759b9d30f25d2f2c538bb41b7a141882bccad7016
SHA512

5a980e86639fa27cd98edfdd484d2fde03b9ecaf773ca95daa8c708bd246cead8e560222bd2322e1ced0d632dd3c805765d0cee0f646d4e72037dffc4a1d8a8a
SSDEEP

12288:GxPgUrdp0oGxDlerc40j5m2AzvccCFGWFOwViPIRO:OvuosW0N3Y5YNU9

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
748	lnpakna.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5116	748	WerFault.exe	88

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 748	1992	f35031dad7ad42ea6ea2fa3759b9d30f25d2f2c538bb41b7a141882bccad7016.exe	88
PID 1992 wrote to memory of 748	1992	f35031dad7ad42ea6ea2fa3759b9d30f25d2f2c538bb41b7a141882bccad7016.exe	88
PID 1992 wrote to memory of 748	1992	f35031dad7ad42ea6ea2fa3759b9d30f25d2f2c538bb41b7a141882bccad7016.exe	88
PID 748 wrote to memory of 2540	748	lnpakna.exe	92
PID 748 wrote to memory of 2540	748	lnpakna.exe	92
PID 748 wrote to memory of 2540	748	lnpakna.exe	92

C:\Users\Admin\AppData\Local\Temp\f35031dad7ad42ea6ea2fa3759b9d30f25d2f2c538bb41b7a141882bccad7016.exe
"C:\Users\Admin\AppData\Local\Temp\f35031dad7ad42ea6ea2fa3759b9d30f25d2f2c538bb41b7a141882bccad7016.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\lnpakna.exe
  "C:\Users\Admin\AppData\Local\Temp\lnpakna.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Users\Admin\AppData\Local\Temp\lnpakna.exe
    "C:\Users\Admin\AppData\Local\Temp\lnpakna.exe"
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 512
    3⤵
    - Program crash
    PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 748 -ip 748
1⤵
PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gxukhxxlqwb.lhh

Filesize
333KB

MD5
94deda5a2638f5952a2ce0c31ad86840

SHA1
0f47f17808ec1e3e21082f0e119fd56c44025b5c

SHA256
3833aed41a086cd57fc8d9df0db5541da24dbd3c0369d438f08fc0315076be6d

SHA512
b215079549e65d8446f16587bafaa596a7d2333edaf62ddb89bf5aebb388c8722f60f5b329dd1df233a2280f94c65c9a533af33e5c3ba913cd0cec6867f74c71

Download Submit
C:\Users\Admin\AppData\Local\Temp\lnpakna.exe

Filesize
166KB

MD5
7c950b4486ea42aefef4212cd948588f

SHA1
62f54d344951856249adc057a630c8f981592a86

SHA256
cc5779e83dbeba1fcdc14ae1277485af40463cdfa3d51842b7c2d3e95a6a6031

SHA512
e4f140c76f1157c96ff541b7a264c8b05f8ca381428f145587368abb12943b4d05c783564b2b8f71c4af9736241919dfbd895348db8a50c65621ae8c9a25d09d

Download Submit
C:\Users\Admin\AppData\Local\Temp\lnpakna.exe

Filesize
166KB

MD5
7c950b4486ea42aefef4212cd948588f

SHA1
62f54d344951856249adc057a630c8f981592a86

SHA256
cc5779e83dbeba1fcdc14ae1277485af40463cdfa3d51842b7c2d3e95a6a6031

SHA512
e4f140c76f1157c96ff541b7a264c8b05f8ca381428f145587368abb12943b4d05c783564b2b8f71c4af9736241919dfbd895348db8a50c65621ae8c9a25d09d

Download Submit
memory/748-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download