649d3f94b88b8c6eeca5d4c4af6cfd85917273ce582504f561f43fbe42246ca5

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58529fb35b0bc5c0be345e195d4c5eb1.exe
Size

94KB
MD5

58529fb35b0bc5c0be345e195d4c5eb1
SHA1

5b1cfece48910bfcbf4d0f13abb11f51ce2c9fa6
SHA256

649d3f94b88b8c6eeca5d4c4af6cfd85917273ce582504f561f43fbe42246ca5
SHA512

2db0075cf9adab78a5db8612569130be1e5c5aeb26423800e80a4528f6aeee23f0bf792bd9d54e0158995618cbbe90bbc34c6087a50f5d705f1e137d5f46b757
SSDEEP

1536:rfg+M2Y9oH+cpTKeyaI0Z/od8bDbRvU5yYeVYXrgITAGXBB3exYEjpepikFIy:rfgyY9oH+cTKGI0Z/oooeVYXrgI0GXW4

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2256	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2256	2084	58529fb35b0bc5c0be345e195d4c5eb1.exe	28
PID 2084 wrote to memory of 2256	2084	58529fb35b0bc5c0be345e195d4c5eb1.exe	28
PID 2084 wrote to memory of 2256	2084	58529fb35b0bc5c0be345e195d4c5eb1.exe	28
PID 2084 wrote to memory of 2256	2084	58529fb35b0bc5c0be345e195d4c5eb1.exe	28

C:\Users\Admin\AppData\Local\Temp\58529fb35b0bc5c0be345e195d4c5eb1.exe
"C:\Users\Admin\AppData\Local\Temp\58529fb35b0bc5c0be345e195d4c5eb1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Mdz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mdz..bat

Filesize
210B

MD5
28978cfed0e1b950ea57676d592cf4b2

SHA1
07456ee086b69e7105b337dea294362cb9dc52e3

SHA256
ec0142b5e21deb8d43975d728a6b432f186da15e7bec09927e3f72fdfa3988b9

SHA512
e3331a60e6eecefc81bc04be1f1fc648bc6f3330be2062d43e5d0176736e0e556b0af9883363856f970d58c30f8cfd1d86c76fafcd6f3687f070a17439406940

Download Submit
memory/2084-1-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2084-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2084-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2084-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2084-5-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download