dd7cdcd0f6a41b4544efb4b53279d5183f4ef21e64f15be932c2fa4578a4b9b6

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bc1df83330f5f8a3aebf7580122127b.exe
Size

170KB
MD5

0bc1df83330f5f8a3aebf7580122127b
SHA1

6e958cb9d477966b40ad66fabcdea415c0147e7e
SHA256

dd7cdcd0f6a41b4544efb4b53279d5183f4ef21e64f15be932c2fa4578a4b9b6
SHA512

62c6cd616e98c30ee9b6996195a3757dea06271ea9201ad36f068e08a1cf432e7adc3f68b91b6d866192fb014be317d07b12b78f54f51fbe886ddf087739a788
SSDEEP

3072:8YL0xqfjyDymJZiY+ovIzqyPo40BEglYtg5mgTtHj5L3HiOZFp:8oBtTovIqyPo40BTlY+5PLHikFp

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2304	0bc1df83330f5f8a3aebf7580122127b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\0bc1df83330f5f8a3aebf7580122127b.exe
"C:\Users\Admin\AppData\Local\Temp\0bc1df83330f5f8a3aebf7580122127b.exe"
1⤵
- Loads dropped DLL
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd47DA.tmp\SimpleFC.dll

Filesize
7KB

MD5
0d55cf36ab6c6f4954dd55aad1ca0a7c

SHA1
c7ccf25dd88986134043131c5479ce6e72ee9d15

SHA256
3547a9b16cf9a4e66bb70333d4d73f7e76330bab6b4acbce7fa8b604e6ae64fc

SHA512
9ba27567899f57d25c6794a2b70f1d4fbf45989e658d862b7666818138e31acfa12a71c7a9595a7ace9b4bc752e38d6044a9fa2231a766b52a7b233d6d6e406d

Download Submit
memory/2304-4-0x00000000003B0000-0x00000000003E0000-memory.dmp

Filesize
192KB

Download