Analysis
-
max time kernel
0s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 18:38
Static task
static1
Behavioral task
behavioral1
Sample
00b7eec8946cdf920a8153e8d3f4475e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
00b7eec8946cdf920a8153e8d3f4475e.exe
Resource
win10v2004-20231222-en
General
-
Target
00b7eec8946cdf920a8153e8d3f4475e.exe
-
Size
2.2MB
-
MD5
00b7eec8946cdf920a8153e8d3f4475e
-
SHA1
9fa1c2d379aa9d21e6dfcdb55097b1eacfcb7b5f
-
SHA256
fe3caabf26e5ae965ad944b70b5ab0026aee8b338317f4e573c72c609988d277
-
SHA512
d0c249a811947d2bc129c38934f076edc821fa80fa3f6904812d550a24390e6e5d87d2156ae0dc183575e7a632af945bb64736d49d1821b1e6620f50c3aa9b9f
-
SSDEEP
49152:AtKOxSdaKij7cpXoI99JXy2x4SqHyY7dzXh0AWDQwGqJu:AFSUKijkX59JXSys0frGqw
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\00b7eec8946cdf920a8153e8d3f4475e.exe"C:\Users\Admin\AppData\Local\Temp\00b7eec8946cdf920a8153e8d3f4475e.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\269ek73z398g4fh.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\269ek73z398g4fh.exe" -e -pk22qa80s3so5mnb2⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\3b5251xmf2ng2b8.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\3b5251xmf2ng2b8.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\3B5251~1.EXE" >> NUL1⤵
-
C:\Users\Admin\AppData\Roaming\Protector-ekpb.exeC:\Users\Admin\AppData\Roaming\Protector-ekpb.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3348-56-0x00000000028E0000-0x00000000028E1000-memory.dmpFilesize
4KB
-
memory/3348-59-0x00000000028E0000-0x00000000028E1000-memory.dmpFilesize
4KB
-
memory/3348-46-0x0000000003560000-0x0000000003660000-memory.dmpFilesize
1024KB
-
memory/3348-48-0x00000000035B0000-0x00000000035B1000-memory.dmpFilesize
4KB
-
memory/3348-49-0x0000000003550000-0x0000000003553000-memory.dmpFilesize
12KB
-
memory/3348-50-0x00000000035C0000-0x00000000035C1000-memory.dmpFilesize
4KB
-
memory/3348-51-0x00000000035A0000-0x00000000035A1000-memory.dmpFilesize
4KB
-
memory/3348-52-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/3348-53-0x0000000003590000-0x0000000003591000-memory.dmpFilesize
4KB
-
memory/3348-45-0x00000000023A0000-0x00000000023FA000-memory.dmpFilesize
360KB
-
memory/3348-47-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/3348-54-0x0000000003580000-0x0000000003581000-memory.dmpFilesize
4KB
-
memory/3348-55-0x00000000023A0000-0x00000000023FA000-memory.dmpFilesize
360KB
-
memory/4120-35-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/4120-33-0x00000000036C0000-0x00000000036C1000-memory.dmpFilesize
4KB
-
memory/4120-58-0x0000000002620000-0x000000000267A000-memory.dmpFilesize
360KB
-
memory/4120-21-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/4120-36-0x00000000036A0000-0x00000000036A1000-memory.dmpFilesize
4KB
-
memory/4120-37-0x0000000003690000-0x0000000003691000-memory.dmpFilesize
4KB
-
memory/4120-38-0x0000000003680000-0x0000000003681000-memory.dmpFilesize
4KB
-
memory/4120-39-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/4120-40-0x00000000029E0000-0x00000000029E1000-memory.dmpFilesize
4KB
-
memory/4120-31-0x00000000036B0000-0x00000000036B1000-memory.dmpFilesize
4KB
-
memory/4120-34-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/4120-57-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/4120-32-0x0000000003650000-0x0000000003653000-memory.dmpFilesize
12KB
-
memory/4120-30-0x00000000038D0000-0x00000000038D1000-memory.dmpFilesize
4KB
-
memory/4120-29-0x0000000003660000-0x0000000003662000-memory.dmpFilesize
8KB
-
memory/4120-27-0x0000000002860000-0x0000000002861000-memory.dmpFilesize
4KB
-
memory/4120-28-0x0000000003670000-0x0000000003671000-memory.dmpFilesize
4KB
-
memory/4120-26-0x0000000002810000-0x0000000002811000-memory.dmpFilesize
4KB
-
memory/4120-25-0x0000000002840000-0x0000000002841000-memory.dmpFilesize
4KB
-
memory/4120-24-0x00000000026C0000-0x00000000026C1000-memory.dmpFilesize
4KB
-
memory/4120-22-0x0000000002620000-0x000000000267A000-memory.dmpFilesize
360KB
-
memory/4120-23-0x00000000026D0000-0x00000000026D1000-memory.dmpFilesize
4KB