761e30e399d824b6dd5e2d2b53ec52119c54ddef08d8660320fb7d9f2161af2c

Analysis

max time kernel
7s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:14

Target

0246ec2968244ca8f09234a8abae4757.exe
Size

1.2MB
MD5

0246ec2968244ca8f09234a8abae4757
SHA1

63aad8ddb7c2ae6a14e651040faf2fdc5d264f48
SHA256

761e30e399d824b6dd5e2d2b53ec52119c54ddef08d8660320fb7d9f2161af2c
SHA512

1f0ba964bf8bf33290f364a4fb4904c0f3c4b9bb05e65206b1a8677e753eebf45ee87a80c1e959d6572e48e7a2de6157d83a83e8e76b5848836471515349bfea
SSDEEP

6144:3e34tPicdq1zQbe9DP3n3BLY6MbEVagKp:zwzQcv3B9dVPA

Score

7^/10

Loads dropped DLL 5 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\0246ec2968244ca8f09234a8abae4757.exe
"C:\Users\Admin\AppData\Local\Temp\0246ec2968244ca8f09234a8abae4757.exe"
1⤵
- Loads dropped DLL
PID:1652

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nst1076.tmp\LangDLL.dll

Filesize
5KB

MD5
9384f4007c492d4fa040924f31c00166

SHA1
aba37faef30d7c445584c688a0b5638f5db31c7b

SHA256
60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

SHA512
68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

Download Submit
memory/1652-26-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/1652-52-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download