3919e77f45a0d6c8e2175ca306324bf9b7307e160a3612e26f85e61c28e397e5

Analysis

max time kernel
2s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00b4d2cb49fb90c3a191793a133e23a1.exe
Size

465KB
MD5

00b4d2cb49fb90c3a191793a133e23a1
SHA1

b52f2a646a408d5bb98e8f34cab1a98cfc83ac98
SHA256

3919e77f45a0d6c8e2175ca306324bf9b7307e160a3612e26f85e61c28e397e5
SHA512

55283f75a8b08d4719d5f4b7f06a755765a152049b63f17df8daeb772d97d764630f3770bdaa62ced3e752fff2d2c32595f143472845649ff4edf06331121fba
SSDEEP

12288:Bb4bZudi79LK93OrSX+tyWMAKPcLklXuFA:Bb4bcdkL9+lW9CcLk

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3448	465F.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3448	465F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 3448	4360	00b4d2cb49fb90c3a191793a133e23a1.exe	18
PID 4360 wrote to memory of 3448	4360	00b4d2cb49fb90c3a191793a133e23a1.exe	18
PID 4360 wrote to memory of 3448	4360	00b4d2cb49fb90c3a191793a133e23a1.exe	18

C:\Users\Admin\AppData\Local\Temp\00b4d2cb49fb90c3a191793a133e23a1.exe
"C:\Users\Admin\AppData\Local\Temp\00b4d2cb49fb90c3a191793a133e23a1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Users\Admin\AppData\Local\Temp\465F.tmp
  "C:\Users\Admin\AppData\Local\Temp\465F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\00b4d2cb49fb90c3a191793a133e23a1.exe 56468F481F2FD05799CA3904D4630E79165BA0B5910C1B3B9B6F4A9A67633D93C8906DC6456E05D87E4665EBE4977304845B00325038A63E0BC6A98E8B075F26
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: RenamesItself
  PID:3448
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\00b4d2cb49fb90c3a191793a133e23a1.doc" /o ""
    3⤵
    PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5008-17-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-22-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-24-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-26-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-28-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-30-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-33-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-34-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-35-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-32-0x00007FFE9D3B0000-0x00007FFE9D3C0000-memory.dmp

Filesize
64KB

Download
memory/5008-31-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-29-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-27-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-25-0x00007FFE9D3B0000-0x00007FFE9D3C0000-memory.dmp

Filesize
64KB

Download
memory/5008-23-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-21-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-20-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-19-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-18-0x00007FFE9F6D0000-0x00007FFE9F6E0000-memory.dmp

Filesize
64KB

Download
memory/5008-16-0x00007FFE9F6D0000-0x00007FFE9F6E0000-memory.dmp

Filesize
64KB

Download
memory/5008-15-0x00007FFE9F6D0000-0x00007FFE9F6E0000-memory.dmp

Filesize
64KB

Download
memory/5008-14-0x00007FFE9F6D0000-0x00007FFE9F6E0000-memory.dmp

Filesize
64KB

Download
memory/5008-13-0x00007FFE9F6D0000-0x00007FFE9F6E0000-memory.dmp

Filesize
64KB

Download
memory/5008-57-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-78-0x00007FFE9F6D0000-0x00007FFE9F6E0000-memory.dmp

Filesize
64KB

Download
memory/5008-81-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-82-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-80-0x00007FFEDF650000-0x00007FFEDF845000-memory.dmp

Filesize
2.0MB

Download
memory/5008-79-0x00007FFE9F6D0000-0x00007FFE9F6E0000-memory.dmp

Filesize
64KB

Download
memory/5008-77-0x00007FFE9F6D0000-0x00007FFE9F6E0000-memory.dmp

Filesize
64KB

Download
memory/5008-76-0x00007FFE9F6D0000-0x00007FFE9F6E0000-memory.dmp

Filesize
64KB

Download