200e0142448c4bccb6e6c24d2563a4922843bf977fcee5fdc4f41ddfdfe3af65

Analysis

max time kernel
111s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65b67ab3bc4ea243830a9a832b780397.exe
Size

327KB
MD5

65b67ab3bc4ea243830a9a832b780397
SHA1

00a7eb407ff8417fa4fe84dbc57c498b968ea334
SHA256

200e0142448c4bccb6e6c24d2563a4922843bf977fcee5fdc4f41ddfdfe3af65
SHA512

5ab76bc79993ffd1c825b4d074220998a891281d8b7c3a9367d97f8585365b74c12710face81fd2a3431a25f6d3af36b52cab67df7635d33763f2e61ea4637ce
SSDEEP

6144:Jr469uEo2S1YnQmCX492DkwNP3qpYFGgjwuBGVdLAt4ZHd2i3gjd+ZD/6FI:Jr4iu6/eIo4Rsw33AtsmQ9

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2520	65b67ab3bc4ea243830a9a832b780397.exe
2520	65b67ab3bc4ea243830a9a832b780397.exe
2520	65b67ab3bc4ea243830a9a832b780397.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	65b67ab3bc4ea243830a9a832b780397.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	65b67ab3bc4ea243830a9a832b780397.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2520	65b67ab3bc4ea243830a9a832b780397.exe
2520	65b67ab3bc4ea243830a9a832b780397.exe

C:\Users\Admin\AppData\Local\Temp\65b67ab3bc4ea243830a9a832b780397.exe
"C:\Users\Admin\AppData\Local\Temp\65b67ab3bc4ea243830a9a832b780397.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tsu55F9FD4E.dll

Filesize
122KB

MD5
79fc46f76330906667d71d7c6dcfcb9b

SHA1
68141e28228e425d239d57ac94b15b54458bc188

SHA256
5c795109b762eb8674b5882fc2ed3ea0eb1d2d84afea77619e4a091478ed1291

SHA512
4665e87a7fafa75233b864e860fcae634cde589b08aaaa21adedd7a41acc2e55222b27e47da39412736472813996b3c6f629aa69a11d191f2c840e510633d364

Download Submit
C:\Users\Admin\AppData\Local\Temp\{91618805-7586-4679-A492-3DA44A82AAF3}\Custom.dll

Filesize
91KB

MD5
c9d3d86ee95ae4d20c80de9ddaa8fa40

SHA1
5f0546ec86f3e27f0eec4d5d5451edc630907654

SHA256
b34ca5ec63459956e72289b6b1d85891377c4ef451b48f42d92ab7d1aad117a9

SHA512
ea895f339e31432497401782a17275cecda18286a158ad191dc1a5c2c3c541205c679689a74ff46c4e4861c7e6d87bf862e54049b419675cadaeea76c400b186

Download Submit
C:\Users\Admin\AppData\Local\Temp\{91618805-7586-4679-A492-3DA44A82AAF3}\_Setup.dll

Filesize
52KB

MD5
5962c003046a111b9ecd7c3bb2bfec8c

SHA1
e970daa759e6ebb8fc86d29f590ac45ca756ae89

SHA256
3b8597ce9e41e07c76a5b737ba1058891b4e66b8654bbe317a7e080a3219d262

SHA512
9158f5777530b7b93a698025fc2e3fd0966ba41b7258678fca97169b983c933d374a1c6149b4c5599ffadf2fc823db01ca1d3a54b850ee2535038d0719e22f53

Download Submit