Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24-12-2023 17:24

General

  • Target

    0859f435bd474351a3bcdcbdc5843d76.exe

  • Size

    142KB

  • MD5

    0859f435bd474351a3bcdcbdc5843d76

  • SHA1

    4e8a67f67b4d89164915266b7e43604f13864a75

  • SHA256

    73dbee33203bc6e3d8ccd5ec69d363b756238739faa0965ecc76faa5817b87ff

  • SHA512

    218df8dc5dd306876d183d34626a7cd9587874f8ca6792e388b4d2878f7a6458d3c5e6b6cce7c99e0ed521865a0a9130197fec86e6c955e72da3ea520c3aa278

  • SSDEEP

    3072:inOn7t7XpdpCCTg/sxFgJKeqgKJ+BCxCD3xxLMlA3FZNlbwhDYi93:iKpdcCrTdgKwTxxL4A3P8

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0859f435bd474351a3bcdcbdc5843d76.exe
    "C:\Users\Admin\AppData\Local\Temp\0859f435bd474351a3bcdcbdc5843d76.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\downloadmr.exe
      C:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\downloadmr.exe /u4dc9054e-38b0-4614-bdd5-20605bc06f26 /e2405794
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\downloadmr.exe

    Filesize

    72KB

    MD5

    a5479185abd7fc40e3735677ec26a594

    SHA1

    eab931c509def4f9469c87461e52246b037a9f8d

    SHA256

    0033e9d54e8e54ce6c7848867e142ec9591992b33bc3a2e91b978595dbb138e6

    SHA512

    a3c864b18f1727d6833ef76c4323e37413d665ec0ae6632d90bdfec9ad033bc1ec0997b89639dc843df7508777555c2f52726a9a1573ec9a13793bcdc2e91655

  • C:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\downloadmr.exe

    Filesize

    78KB

    MD5

    57e08327e0d11464fe8fe721f8f68125

    SHA1

    ab96053068b9d3d0b59f137e22c6d0796a36db89

    SHA256

    2291640abb6040b394d02d3422a8dfa07121d763f45ad54cde09a117497a0450

    SHA512

    1b6d9d9847dd9b1abd2214cc8226c3c9484a308be7b64604b0cd0285b056a8768ca40c0b6f1b6896dff0e7f1efb480b347fe95b3c7ca471dbbe2396f252f678e

  • C:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\downloadmr.exe

    Filesize

    122KB

    MD5

    1afeaddf17a41984504267580f1789b2

    SHA1

    9bde0dc0c2a5fae12506ca3b835f86c08c3b693c

    SHA256

    1c7763617e3cb3589132920a4acf2b4a6ffce147a53f4b63c5933900a73efad4

    SHA512

    a24c93cd7e81ee6d39294af00e2ae3f4b271034880e93e89d58b4f2866b3a00ce9d7270e2b751896cbfe2ad32d92969a3aafc57cc2b10a930cd14ecabe62044f

  • \Users\Admin\AppData\Local\Temp\nsy196C.tmp\System.dll

    Filesize

    21KB

    MD5

    5ebc73650256e9c8ddbcda231db829a1

    SHA1

    988d4535e18754ab2a6248abae96c5697d7dbcd5

    SHA256

    1eaa543842df7795404184e8892a1654b0773dbc9bd8b54c7fdb9e68f4355493

    SHA512

    b21266e76fc7263af982a1336a766e47ccf348ed56b305dbb09f03574c9b2a7309f12200e80d86f9a251381be6e87a41206447f11c51899cb31fba10da1d5270

  • \Users\Admin\AppData\Local\Temp\nsy196C.tmp\downloadmr.exe

    Filesize

    84KB

    MD5

    f5a613f1964a32632a5570b8793db862

    SHA1

    26a3627d3dfdae14b2ab5422900fb4e6f0924e4c

    SHA256

    a4eac09a4128e9738778aeff508bbc1fcf0b413aa006823ac053f6f3c3d77408

    SHA512

    5361e8c00b344a303dec1fb3507bf3744d62490773eaee4a25f16ac076284696c31ef650f274900a52dba3a1c30fca247ff7f54d6145e9c4d0bfb8996777a540

  • \Users\Admin\AppData\Local\Temp\nsy196C.tmp\downloadmr.exe

    Filesize

    122KB

    MD5

    da254a8488b60244654e1cf4d6796cf8

    SHA1

    23d06f4589786652a3a226b5012a5520a3d03452

    SHA256

    6d3b82a7ad74a1e88ae4d0f9176082130f1558fb3ff42a8b45ca8b80445efc2d

    SHA512

    d311f90ad65441f6c7ae55220c2c3f117aa7601d083e6847e1b58b96c3c332d68a25d445310818396dc88678fb9ec5356f35a04a392c3d23746a2231e14b0a2e

  • memory/2968-30-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2996-19-0x0000000074820000-0x0000000074DCB000-memory.dmp

    Filesize

    5.7MB

  • memory/2996-20-0x0000000000650000-0x0000000000690000-memory.dmp

    Filesize

    256KB

  • memory/2996-22-0x0000000000650000-0x0000000000690000-memory.dmp

    Filesize

    256KB

  • memory/2996-21-0x0000000000650000-0x0000000000690000-memory.dmp

    Filesize

    256KB

  • memory/2996-23-0x0000000000650000-0x0000000000690000-memory.dmp

    Filesize

    256KB

  • memory/2996-25-0x0000000006380000-0x0000000006480000-memory.dmp

    Filesize

    1024KB

  • memory/2996-24-0x0000000000650000-0x0000000000690000-memory.dmp

    Filesize

    256KB

  • memory/2996-18-0x0000000074820000-0x0000000074DCB000-memory.dmp

    Filesize

    5.7MB

  • memory/2996-26-0x0000000074820000-0x0000000074DCB000-memory.dmp

    Filesize

    5.7MB