Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24-12-2023 17:24
Static task
static1
Behavioral task
behavioral1
Sample
0859f435bd474351a3bcdcbdc5843d76.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0859f435bd474351a3bcdcbdc5843d76.exe
Resource
win10v2004-20231215-en
General
-
Target
0859f435bd474351a3bcdcbdc5843d76.exe
-
Size
142KB
-
MD5
0859f435bd474351a3bcdcbdc5843d76
-
SHA1
4e8a67f67b4d89164915266b7e43604f13864a75
-
SHA256
73dbee33203bc6e3d8ccd5ec69d363b756238739faa0965ecc76faa5817b87ff
-
SHA512
218df8dc5dd306876d183d34626a7cd9587874f8ca6792e388b4d2878f7a6458d3c5e6b6cce7c99e0ed521865a0a9130197fec86e6c955e72da3ea520c3aa278
-
SSDEEP
3072:inOn7t7XpdpCCTg/sxFgJKeqgKJ+BCxCD3xxLMlA3FZNlbwhDYi93:iKpdcCrTdgKwTxxL4A3P8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2996 downloadmr.exe -
Loads dropped DLL 4 IoCs
pid Process 2968 0859f435bd474351a3bcdcbdc5843d76.exe 2968 0859f435bd474351a3bcdcbdc5843d76.exe 2968 0859f435bd474351a3bcdcbdc5843d76.exe 2968 0859f435bd474351a3bcdcbdc5843d76.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2996 downloadmr.exe 2996 downloadmr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2996 2968 0859f435bd474351a3bcdcbdc5843d76.exe 28 PID 2968 wrote to memory of 2996 2968 0859f435bd474351a3bcdcbdc5843d76.exe 28 PID 2968 wrote to memory of 2996 2968 0859f435bd474351a3bcdcbdc5843d76.exe 28 PID 2968 wrote to memory of 2996 2968 0859f435bd474351a3bcdcbdc5843d76.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0859f435bd474351a3bcdcbdc5843d76.exe"C:\Users\Admin\AppData\Local\Temp\0859f435bd474351a3bcdcbdc5843d76.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\downloadmr.exeC:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\downloadmr.exe /u4dc9054e-38b0-4614-bdd5-20605bc06f26 /e24057942⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5a5479185abd7fc40e3735677ec26a594
SHA1eab931c509def4f9469c87461e52246b037a9f8d
SHA2560033e9d54e8e54ce6c7848867e142ec9591992b33bc3a2e91b978595dbb138e6
SHA512a3c864b18f1727d6833ef76c4323e37413d665ec0ae6632d90bdfec9ad033bc1ec0997b89639dc843df7508777555c2f52726a9a1573ec9a13793bcdc2e91655
-
Filesize
78KB
MD557e08327e0d11464fe8fe721f8f68125
SHA1ab96053068b9d3d0b59f137e22c6d0796a36db89
SHA2562291640abb6040b394d02d3422a8dfa07121d763f45ad54cde09a117497a0450
SHA5121b6d9d9847dd9b1abd2214cc8226c3c9484a308be7b64604b0cd0285b056a8768ca40c0b6f1b6896dff0e7f1efb480b347fe95b3c7ca471dbbe2396f252f678e
-
Filesize
122KB
MD51afeaddf17a41984504267580f1789b2
SHA19bde0dc0c2a5fae12506ca3b835f86c08c3b693c
SHA2561c7763617e3cb3589132920a4acf2b4a6ffce147a53f4b63c5933900a73efad4
SHA512a24c93cd7e81ee6d39294af00e2ae3f4b271034880e93e89d58b4f2866b3a00ce9d7270e2b751896cbfe2ad32d92969a3aafc57cc2b10a930cd14ecabe62044f
-
Filesize
21KB
MD55ebc73650256e9c8ddbcda231db829a1
SHA1988d4535e18754ab2a6248abae96c5697d7dbcd5
SHA2561eaa543842df7795404184e8892a1654b0773dbc9bd8b54c7fdb9e68f4355493
SHA512b21266e76fc7263af982a1336a766e47ccf348ed56b305dbb09f03574c9b2a7309f12200e80d86f9a251381be6e87a41206447f11c51899cb31fba10da1d5270
-
Filesize
84KB
MD5f5a613f1964a32632a5570b8793db862
SHA126a3627d3dfdae14b2ab5422900fb4e6f0924e4c
SHA256a4eac09a4128e9738778aeff508bbc1fcf0b413aa006823ac053f6f3c3d77408
SHA5125361e8c00b344a303dec1fb3507bf3744d62490773eaee4a25f16ac076284696c31ef650f274900a52dba3a1c30fca247ff7f54d6145e9c4d0bfb8996777a540
-
Filesize
122KB
MD5da254a8488b60244654e1cf4d6796cf8
SHA123d06f4589786652a3a226b5012a5520a3d03452
SHA2566d3b82a7ad74a1e88ae4d0f9176082130f1558fb3ff42a8b45ca8b80445efc2d
SHA512d311f90ad65441f6c7ae55220c2c3f117aa7601d083e6847e1b58b96c3c332d68a25d445310818396dc88678fb9ec5356f35a04a392c3d23746a2231e14b0a2e