116c2f5a645d296836e8ea1661362c2261516e7ed6f1141ec41d7401a642c013

Analysis

max time kernel
134s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:54

Target

025ac5b2491b654459e4636a68a0f778.exe
Size

243KB
MD5

025ac5b2491b654459e4636a68a0f778
SHA1

929ba8a046c681628743952ea38ffeedb964a5f3
SHA256

116c2f5a645d296836e8ea1661362c2261516e7ed6f1141ec41d7401a642c013
SHA512

d8dbfa1bdbe072a49f322effc744ddcef3459e82731b017fe842eabb610ca7919298388dd098e1fb178bac7c63191d3c110ae1f4353d6142d44b388f30ab54db
SSDEEP

6144:beTeM/ogKXlr25MrQtliie6Z6DuWfh7qaSsis8q1lWR:vMQv8wbKe7qaVVU

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1764	explorer.exe

Loads dropped DLL 3 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3456 set thread context of 1764	3456	025ac5b2491b654459e4636a68a0f778.exe	92

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSealMod\SVHelpe.exe	025ac5b2491b654459e4636a68a0f778.exe
File created	C:\Program Files (x86)\MSealMod\t2fp.dll	025ac5b2491b654459e4636a68a0f778.exe
File created	C:\Program Files (x86)\MSealMod\cblock.dll	025ac5b2491b654459e4636a68a0f778.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 1764	3456	025ac5b2491b654459e4636a68a0f778.exe	92
PID 3456 wrote to memory of 1764	3456	025ac5b2491b654459e4636a68a0f778.exe	92
PID 3456 wrote to memory of 1764	3456	025ac5b2491b654459e4636a68a0f778.exe	92
PID 3456 wrote to memory of 1764	3456	025ac5b2491b654459e4636a68a0f778.exe	92

C:\Users\Admin\AppData\Local\Temp\025ac5b2491b654459e4636a68a0f778.exe
"C:\Users\Admin\AppData\Local\Temp\025ac5b2491b654459e4636a68a0f778.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Deletes itself
  PID:1764

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsx2566.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx2566.tmp\SelfDel.dll

Filesize
4KB

MD5
5e14f6774c43bdff6ffe0afb0d51c47f

SHA1
fb1e7b6e63afa6db6aa2033b5e7e90f1f4ba5e27

SHA256
7cb51ccf21655e9590a6c3232920b16a3dfef15ffe9df7b8e71f487ca8c24da9

SHA512
6ac533c0485156a68bd1460d8219acf7539b766590910cd646f4d7d4572c072f45369712d88d4e698f4e94aead8082abcbfacc3d6fe890046898f6c6d85274e3

Download Submit
memory/3456-7-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download