23e36bbecb17b3499a8f72566d24a6ae3dc9ca60049bf68c838fb3cd387ed526

Analysis

max time kernel
186s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

470ba5b7e34f8f4eef5d9b28f8a4923b.exe
Size

1.7MB
MD5

470ba5b7e34f8f4eef5d9b28f8a4923b
SHA1

d5d3d7db210b1e4d22d0c73c1527fcb3bd0d9f7c
SHA256

23e36bbecb17b3499a8f72566d24a6ae3dc9ca60049bf68c838fb3cd387ed526
SHA512

6a1341f2462d9505e876a232eecadd9c3f34744f8cf4cdd532658f77b446c756d8fc443e03076ac8835e6c33b8f2cff62c14765d76d372e865a1b65f36166295
SSDEEP

24576:7ScOqSPLtNZp3lOZ+FbCUndZYjXoAgkmHVLBMfsG3pC6d41eCXH7gyX7CY:XAPLxLOZ+FnnmFgkmV+pC6d4vbgCf

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2132	470ba5b7e34f8f4eef5d9b28f8a4923b.exe
2132	470ba5b7e34f8f4eef5d9b28f8a4923b.exe
2132	470ba5b7e34f8f4eef5d9b28f8a4923b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2132	470ba5b7e34f8f4eef5d9b28f8a4923b.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2132	470ba5b7e34f8f4eef5d9b28f8a4923b.exe

C:\Users\Admin\AppData\Local\Temp\470ba5b7e34f8f4eef5d9b28f8a4923b.exe
"C:\Users\Admin\AppData\Local\Temp\470ba5b7e34f8f4eef5d9b28f8a4923b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstC0FB.tmp\BDMSkin.dll

Filesize
128KB

MD5
20a252a8efe7b9b6a50cbbae5323a284

SHA1
5db13e176cd1f44752bd0d65f50d5d56980bc6bc

SHA256
c3464ae5dad1ad47912efc26035e6b78026a2f4b3bc84108c8a9cd111c0a2bf2

SHA512
cf77d270b6db425d09c8a085649e66bf381485c0e1c2aa2d570d49b83dfe3b3446f36a2fd7cad89be58896511a213a66603a84dddedd98ba891152305b69308a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC0FB.tmp\BDMSkin.dll

Filesize
64KB

MD5
ed21b5ba657ffddd236e59f699f5a0d6

SHA1
1a6e421ebd39ea0c9037db7f1339718afe8b9367

SHA256
37e8a010620bf912fcf0ea55013bd81418aea09280c7db8140fa5fda28134a8f

SHA512
7ae63bb193eaeabc9cd9ce9e31af2db7324d2c61fcd0ae96628f0572cc4012bfc57911aaf6b6520ce040376367a3258d5402c7c61080990258c080ca82a8e867

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC0FB.tmp\BDMSkin.dll

Filesize
770KB

MD5
806bc5d8fed9c62a49a6b6006df8ec17

SHA1
c24efad6b0dd2623c1d5069075aa5554067356d1

SHA256
80c84fe483bed4bae336d939fb460f4847214e380049e2c838bb6366817c80d0

SHA512
f89ccd14e8fef401a0fbaf4ee602513c16e469289ebd2ae66da67c7c227205761e9859572cb5e56d42cb302b633ae7e0a67700f0d6fd421e1e7a807504ae02ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC0FB.tmp\tmpf5clx2.dll

Filesize
588KB

MD5
883870c98b16531ee96a80599fbcb0e6

SHA1
31fe918ab9d3df641f50c94845a392c7ee8d175f

SHA256
7e79634c6b95b3ed84d8393a61749cc9a89c72bf48c5665366a82ba9207dbbaf

SHA512
3372fb0e98d0abcbdb5c0f84efc2cab1f3110934c71cb844790ba4aa87b5ef8d1343a82bbed90b75c9bcc4a742a63b1cdfdcd735a145fa6d307dbb1bf8e8c835

Download Submit
memory/2132-13-0x0000000003090000-0x00000000031D3000-memory.dmp

Filesize
1.3MB

Download