Analysis

  • max time kernel
    147s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 00:36

General

  • Target

    46df060c824bd983d8d876d2f7b34eab.exe

  • Size

    3.8MB

  • MD5

    46df060c824bd983d8d876d2f7b34eab

  • SHA1

    01b138c72c1675acb7025328a02f1c2d4f582788

  • SHA256

    60bb0870ecb3dff99cd0c9e3f4971817329f95ec29ce96b19b23c0744e688019

  • SHA512

    f95fac2e210ad4ff671ab1edfb23ccb4892d9b5545a88b5d4805f1f369d277abbf16340ca15d163e898837101193da4c4c2927f0de3bb5bfae1f178ff62a918b

  • SSDEEP

    98304:aCWcZE1nsF6n+cLvX3dU/XRAz5rOzO4MiEnR7HuQotK7oqp:aCWzFNHIXGOJMi8R7+K7p

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46df060c824bd983d8d876d2f7b34eab.exe
    "C:\Users\Admin\AppData\Local\Temp\46df060c824bd983d8d876d2f7b34eab.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:3848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsd4E03.tmp\tools.dll

    Filesize

    92KB

    MD5

    61f13923380b3f70bdb47193e0d905dd

    SHA1

    d78f3fb5996cc9fa649c2d86c5b53bcf0f3e2dcd

    SHA256

    edcc645a5ad7720b7f1b18b03a79b19e050595893bd9ab8c053191336c316247

    SHA512

    e82c8410ad435cf26e4c7cd3affdde58687ca7908cc93488ccfa058ba560bbd03d16516af21517048de8115c1826a65ef647068799a3d46cafb990370a5ed8d7

  • memory/3848-30-0x0000000003400000-0x0000000003410000-memory.dmp

    Filesize

    64KB

  • memory/3848-32-0x0000000073D30000-0x00000000742E1000-memory.dmp

    Filesize

    5.7MB

  • memory/3848-27-0x0000000003400000-0x0000000003410000-memory.dmp

    Filesize

    64KB

  • memory/3848-26-0x0000000003400000-0x0000000003410000-memory.dmp

    Filesize

    64KB

  • memory/3848-23-0x0000000073D30000-0x00000000742E1000-memory.dmp

    Filesize

    5.7MB

  • memory/3848-29-0x0000000003400000-0x0000000003410000-memory.dmp

    Filesize

    64KB

  • memory/3848-19-0x0000000003400000-0x0000000003410000-memory.dmp

    Filesize

    64KB

  • memory/3848-24-0x0000000073D30000-0x00000000742E1000-memory.dmp

    Filesize

    5.7MB

  • memory/3848-31-0x0000000003400000-0x0000000003410000-memory.dmp

    Filesize

    64KB

  • memory/3848-34-0x0000000003400000-0x0000000003410000-memory.dmp

    Filesize

    64KB

  • memory/3848-33-0x0000000003400000-0x0000000003410000-memory.dmp

    Filesize

    64KB

  • memory/3848-35-0x0000000003400000-0x0000000003410000-memory.dmp

    Filesize

    64KB

  • memory/3848-37-0x0000000003400000-0x0000000003410000-memory.dmp

    Filesize

    64KB

  • memory/3848-36-0x0000000003400000-0x0000000003410000-memory.dmp

    Filesize

    64KB

  • memory/3848-38-0x0000000003400000-0x0000000003410000-memory.dmp

    Filesize

    64KB