Analysis

  • max time kernel
    121s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 22:26

General

  • Target

    40097ab04c07967c3a1d909de365bf06.exe

  • Size

    378KB

  • MD5

    40097ab04c07967c3a1d909de365bf06

  • SHA1

    445d94243947a5b51de516befbf7c488982e57a6

  • SHA256

    14318e172b1618cf07c7356153a899a5cc0e4f2604dcc19193d3bf6b33e9e2e9

  • SHA512

    bbe47c49badf4e9dd5d7b46ba5ea1b27272812c448783d74293dfbed082017d8d26bce2dd2bb1b21c4c665fb7b44b1a516b85c930fe2201ac229081c3c7cffb5

  • SSDEEP

    6144:5Aposi6JTwjVSy79sgfyx5uK9ulnOiAJ7bd9+guy007gy1oAYmqVY51Fuz2tBY:4W6JTuIy7sL9L3Jr+mHszSBY

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\40097ab04c07967c3a1d909de365bf06.exe
    "C:\Users\Admin\AppData\Local\Temp\40097ab04c07967c3a1d909de365bf06.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Drops file in Windows directory
    PID:1796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\{a78b4901-d77a-b798-a78b-b4901d772407}\40097ab04c07967c3a1d909de365bf06.exe

    Filesize

    378KB

    MD5

    40097ab04c07967c3a1d909de365bf06

    SHA1

    445d94243947a5b51de516befbf7c488982e57a6

    SHA256

    14318e172b1618cf07c7356153a899a5cc0e4f2604dcc19193d3bf6b33e9e2e9

    SHA512

    bbe47c49badf4e9dd5d7b46ba5ea1b27272812c448783d74293dfbed082017d8d26bce2dd2bb1b21c4c665fb7b44b1a516b85c930fe2201ac229081c3c7cffb5

  • memory/1796-23-0x00000000000B0000-0x00000000000B1000-memory.dmp

    Filesize

    4KB

  • memory/1796-4-0x0000000000F70000-0x0000000000F9F000-memory.dmp

    Filesize

    188KB

  • memory/1796-21-0x0000000001000000-0x0000000001001000-memory.dmp

    Filesize

    4KB

  • memory/1796-18-0x0000000000F10000-0x0000000000F11000-memory.dmp

    Filesize

    4KB

  • memory/1796-7-0x00000000008A0000-0x00000000008A1000-memory.dmp

    Filesize

    4KB

  • memory/1796-0-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/1796-19-0x0000000000F60000-0x0000000000F61000-memory.dmp

    Filesize

    4KB

  • memory/1796-20-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

    Filesize

    4KB

  • memory/1796-26-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/1796-25-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

    Filesize

    4KB

  • memory/1796-24-0x0000000000880000-0x0000000000881000-memory.dmp

    Filesize

    4KB

  • memory/1796-2-0x0000000000860000-0x0000000000861000-memory.dmp

    Filesize

    4KB

  • memory/1796-36-0x0000000000D80000-0x0000000000D81000-memory.dmp

    Filesize

    4KB

  • memory/1796-3-0x0000000000870000-0x0000000000871000-memory.dmp

    Filesize

    4KB

  • memory/1796-5-0x0000000000890000-0x0000000000891000-memory.dmp

    Filesize

    4KB

  • memory/1796-17-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

    Filesize

    4KB

  • memory/1796-16-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

    Filesize

    4KB

  • memory/1796-15-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

    Filesize

    4KB

  • memory/1796-14-0x0000000000A60000-0x0000000000A61000-memory.dmp

    Filesize

    4KB

  • memory/1796-13-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

    Filesize

    4KB

  • memory/1796-12-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

    Filesize

    4KB

  • memory/1796-11-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

    Filesize

    4KB

  • memory/1796-9-0x0000000000A50000-0x0000000000A51000-memory.dmp

    Filesize

    4KB

  • memory/1796-1-0x00000000000A0000-0x00000000000A1000-memory.dmp

    Filesize

    4KB

  • memory/1796-35-0x0000000000D80000-0x0000000000D81000-memory.dmp

    Filesize

    4KB

  • memory/1796-22-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB