b3a0c45da18b463bd762477750160f9e56c3b29c942e8148ee5a6c8e8973b6a0

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cb0c055b0e3297c871246e3e7c180ad.exe
Size

41KB
MD5

3cb0c055b0e3297c871246e3e7c180ad
SHA1

8f40cfc42839d63c297d01cffb2cecfa8f53f56f
SHA256

b3a0c45da18b463bd762477750160f9e56c3b29c942e8148ee5a6c8e8973b6a0
SHA512

b9f604d79636a7dceb8056b8dfc3d5e840f41fb6cfd63facb7759c282336308f1f76c82d86b4a035203e0039454ba8ec8f2f735c6544188d378d7aa23d83fd21
SSDEEP

768:QIBar1ZIZYnfI9opm6AIHIjaI7g9mVmUnboNE/W5dRV8:pW1ZIZqI9opm6AIHIjzmUMNzd

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2668	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1704	sxhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1144	3cb0c055b0e3297c871246e3e7c180ad.exe
1144	3cb0c055b0e3297c871246e3e7c180ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1704	1144	3cb0c055b0e3297c871246e3e7c180ad.exe	28
PID 1144 wrote to memory of 1704	1144	3cb0c055b0e3297c871246e3e7c180ad.exe	28
PID 1144 wrote to memory of 1704	1144	3cb0c055b0e3297c871246e3e7c180ad.exe	28
PID 1144 wrote to memory of 1704	1144	3cb0c055b0e3297c871246e3e7c180ad.exe	28
PID 1144 wrote to memory of 2668	1144	3cb0c055b0e3297c871246e3e7c180ad.exe	29
PID 1144 wrote to memory of 2668	1144	3cb0c055b0e3297c871246e3e7c180ad.exe	29
PID 1144 wrote to memory of 2668	1144	3cb0c055b0e3297c871246e3e7c180ad.exe	29
PID 1144 wrote to memory of 2668	1144	3cb0c055b0e3297c871246e3e7c180ad.exe	29
PID 1704 wrote to memory of 2356	1704	sxhost.exe	32
PID 1704 wrote to memory of 2356	1704	sxhost.exe	32
PID 1704 wrote to memory of 2356	1704	sxhost.exe	32
PID 1704 wrote to memory of 2356	1704	sxhost.exe	32

C:\Users\Admin\AppData\Local\Temp\3cb0c055b0e3297c871246e3e7c180ad.exe
"C:\Users\Admin\AppData\Local\Temp\3cb0c055b0e3297c871246e3e7c180ad.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\sxhost.exe
  "C:\Users\Admin\sxhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del C:\Users\Admin\sxhost.exe >> NUL
    3⤵
    PID:2356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3CB0C0~1.EXE >> NUL
  2⤵
  - Deletes itself
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\sxhost.exe

Filesize
41KB

MD5
3cb0c055b0e3297c871246e3e7c180ad

SHA1
8f40cfc42839d63c297d01cffb2cecfa8f53f56f

SHA256
b3a0c45da18b463bd762477750160f9e56c3b29c942e8148ee5a6c8e8973b6a0

SHA512
b9f604d79636a7dceb8056b8dfc3d5e840f41fb6cfd63facb7759c282336308f1f76c82d86b4a035203e0039454ba8ec8f2f735c6544188d378d7aa23d83fd21

Download Submit
memory/1144-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1144-9-0x0000000000700000-0x0000000000715000-memory.dmp

Filesize
84KB

Download
memory/1144-11-0x0000000000700000-0x0000000000715000-memory.dmp

Filesize
84KB

Download
memory/1144-13-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1704-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1704-17-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download