24a0834c8c757080f4bf781ee5965dfe01813d9c3f3c4244f4cf2a23797182df

Analysis

max time kernel
1s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

608ec8238b294454c6ed5f3d49ed191a.exe
Size

1.7MB
MD5

608ec8238b294454c6ed5f3d49ed191a
SHA1

a58f71d7715803c7a97c5bcd7b3e24a738031bb6
SHA256

24a0834c8c757080f4bf781ee5965dfe01813d9c3f3c4244f4cf2a23797182df
SHA512

f70763b6622bb09feac7ddca00a2ab9e2191922388dca8a74c9acb1b0db3120f77c457d36be4ffd208b65ebff33e749eae7353c48aa0878917445cf124eb57f3
SSDEEP

49152:BG197mp3kgdETNjsc3jupISfqYjPnZLSr5LL1VjG+V:Bitmp09TNIwYIW7FSr5LTjGi

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4252	608ec8238b294454c6ed5f3d49ed191a.exe
4252	608ec8238b294454c6ed5f3d49ed191a.exe
4252	608ec8238b294454c6ed5f3d49ed191a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\608ec8238b294454c6ed5f3d49ed191a.exe
"C:\Users\Admin\AppData\Local\Temp\608ec8238b294454c6ed5f3d49ed191a.exe"
1⤵
- Loads dropped DLL
PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsv4865.tmp\BDMSkin.dll

Filesize
1.3MB

MD5
b540a866191f7fd20f5e6355bc2b094e

SHA1
df01a0c011e88a1f860db41d474d3fe893f06082

SHA256
ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

SHA512
e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4865.tmp\tmpncwmp4.dll

Filesize
648KB

MD5
52989f454fde8e9856781046d00d3225

SHA1
914b768d4964ab7225599c29c4908f8783dd514d

SHA256
fd4ea10a67c3cea97830cff14a507bd8db9a871896e74eb859fef9f4a91d6430

SHA512
8ca4b6bada954e43f2cbbe8a2ea73f77c40d778c9a4b790222a094ba7abcf88a0b28571b99bbb4db3ba22f31e05273e2ec879fb24d6e4785f32a4884cf27aefb

Download Submit
memory/4252-13-0x0000000003090000-0x00000000031D3000-memory.dmp

Filesize
1.3MB

Download