23fbb16beee454e4ca28ff93fcd2052f0b6165b400a54669c356aadae78c6882

Analysis

max time kernel
140s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03f35bd9d8825be47bedfb1800b64a01.exe
Size

495KB
MD5

03f35bd9d8825be47bedfb1800b64a01
SHA1

8f93bb6f203bde6b5886e6a943fc07738f69a5f7
SHA256

23fbb16beee454e4ca28ff93fcd2052f0b6165b400a54669c356aadae78c6882
SHA512

50060b3447a45947dedbf81f06c3cb0690d80c91f4add79274fc20dbdb8ff8c73420a582f883bf2d4ac27e2792a2d4d7f8ce4d61790feb58dc79ac425b857d25
SSDEEP

6144:Be34R2QANzh36dqXEVTrnCRZG/t7FTBqTzP7n7O7L6K2Bfo7px:52xzh36VVTGf0ZTsnz7O7L6ju7px

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
112	03f35bd9d8825be47bedfb1800b64a01.exe
112	03f35bd9d8825be47bedfb1800b64a01.exe
112	03f35bd9d8825be47bedfb1800b64a01.exe
112	03f35bd9d8825be47bedfb1800b64a01.exe
112	03f35bd9d8825be47bedfb1800b64a01.exe
112	03f35bd9d8825be47bedfb1800b64a01.exe
112	03f35bd9d8825be47bedfb1800b64a01.exe
112	03f35bd9d8825be47bedfb1800b64a01.exe
112	03f35bd9d8825be47bedfb1800b64a01.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\03f35bd9d8825be47bedfb1800b64a01.exe
"C:\Users\Admin\AppData\Local\Temp\03f35bd9d8825be47bedfb1800b64a01.exe"
1⤵
- Loads dropped DLL
PID:112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsu9DE7.tmp\BrandingURL.dll

Filesize
4KB

MD5
71c46b663baa92ad941388d082af97e7

SHA1
5a9fcce065366a526d75cc5ded9aade7cadd6421

SHA256
bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

SHA512
5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu9DE7.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu9DE7.tmp\LangDLL.dll

Filesize
5KB

MD5
9384f4007c492d4fa040924f31c00166

SHA1
aba37faef30d7c445584c688a0b5638f5db31c7b

SHA256
60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

SHA512
68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu9DE7.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu9DE7.tmp\UAC.dll

Filesize
17KB

MD5
09caf01bc8d88eeb733abc161acff659

SHA1
b8c2126d641f88628c632dd2259686da3776a6da

SHA256
3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478

SHA512
ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu9DE7.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu9DE7.tmp\ioSpecial.ini

Filesize
1KB

MD5
fcf13fc06770dca218364d15428e4db9

SHA1
fa7c6945b3980b788199e0cc934f29888a94fcc7

SHA256
5c8b26dde229b86224f2ef22a4ea5755322486d3bf31eeffa1cc89acd1038226

SHA512
49ba5cd94b66db21e0dc8cada9841bb617847585c6debd3798df88f764672c17c60b41e4b1c5814bacc6120fe0505c23b7b892ea1320ec5fb460cdc7a5445344

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu9DE7.tmp\ioSpecial.ini

Filesize
405B

MD5
f387905060eaf454be0d5a6c08324d04

SHA1
c0cf53ccf752bf708debc2b6e305826f784b5189

SHA256
066489560508e0291dc29fcd8ad14d371de325f501e925beea9d1d0ecc8ac09e

SHA512
30312c0d423b2583257024b1ae2a5797dc9a3467d3f9f9cbc21beaffbbbe48930fb35bd88f566d8c5102c17c8f1df71d957d51dafaae2050dcc2b0df3eaf1475

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu9DE7.tmp\ioSpecial.ini

Filesize
1KB

MD5
d9bcf49495c7ab577783cbd2fa52f866

SHA1
ef2d8ed4b9a5b66dd7819414c759a0ca248c16b4

SHA256
5577f580843cd4fa7e67d0ee9649a10fcc75474057639bf8b1054d99a2b7d9e8

SHA512
778a0642412dc929af80f34db565e1f3947dea7c5bada78b8366e1fc4404c8b2cb77641082e63d921476a3bbdc577e2dc6d0d2f721b1ac16d7283d37dfe11db8

Download Submit