711fc2b4f30a506f114fa75d0ec54c0345691bec1e5a4692780fb85a808bc38f

Analysis

max time kernel
157s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d32878aea97c55d4557ba8d3fcf2c35.exe
Size

760KB
MD5

0d32878aea97c55d4557ba8d3fcf2c35
SHA1

08e76587fa4c81667088959533832ae05eda0dec
SHA256

711fc2b4f30a506f114fa75d0ec54c0345691bec1e5a4692780fb85a808bc38f
SHA512

c9c56d9c20bbb31976523d0892b3aec2ff89df639380378b5f8d15e0c9bea9b5dbd83d15c11f2b4588d00e058418c99ffc8e74500b4a6ac1179e2736f61299d4
SSDEEP

12288:wvmN2ys4ZfodyZl7OAUSmTRYTLBdTwIww4OHUi1t06kCCgYdsRpN:wvm64ZfTl77ATKXk3qHT1tBkzgYe

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

0d32878aea97c55d4557ba8d3fcf2c35.exe

pid process

4740 0d32878aea97c55d4557ba8d3fcf2c35.exe
4740 0d32878aea97c55d4557ba8d3fcf2c35.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4740	0d32878aea97c55d4557ba8d3fcf2c35.exe
4740	0d32878aea97c55d4557ba8d3fcf2c35.exe

C:\Users\Admin\AppData\Local\Temp\0d32878aea97c55d4557ba8d3fcf2c35.exe
"C:\Users\Admin\AppData\Local\Temp\0d32878aea97c55d4557ba8d3fcf2c35.exe"
1⤵
- Loads dropped DLL
PID:4740

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsxB1EC.tmp\InstallOptions.dll
Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxB1EC.tmp\LangDLL.dll
Filesize
5KB

MD5
9384f4007c492d4fa040924f31c00166

SHA1
aba37faef30d7c445584c688a0b5638f5db31c7b

SHA256
60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

SHA512
68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxB1EC.tmp\ioSpecial.ini
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxB1EC.tmp\ioSpecial.ini
Filesize
656B

MD5
fd6e6273fe33d88afc9703ec7b9e6ac4

SHA1
4734712f49a33f9791283d6184d6902b20f492a8

SHA256
b71398c259e6a55c4181bdb64a1c194fef2cfadbd7556a1040a27817654f92b3

SHA512
7d8d6a4dbf7837d65c8e8395f8f63a7acc305c1bf3dabd09870de951d397f438ec9f8dd516ddfb62a42f295460a5da93df08450eb6153db9d79367c6d5c2bb72

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxB1EC.tmp\ioSpecial.ini
Filesize
695B

MD5
3a04a87d35e3fd4a19e05015e0ee8cb3

SHA1
45b76dcba6e362667049a858aab83ee54c56a908

SHA256
54fc68dc987b3c58f11f2e29fcac5ec9d693f61c7a009a4ecad7e90a88e53003

SHA512
d84e607d8c6866a00694309b99b30c57a855dff4b1d750cc0e170e8b124f99c8745dec54d584381a0f70bf4aa8568558412a60e2df68d231bb1564ae726051d7

Download Submit