ab082dbe7eb5af2ccacf9fc1fc68292cad73236ff3f13b453369c42c45818a5f

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14d36fc4a50ce83ebd8dc8f0f039e115.exe
Size

1.5MB
MD5

14d36fc4a50ce83ebd8dc8f0f039e115
SHA1

755f3de59a7c4f065a2650e46dec19fbda14afa3
SHA256

ab082dbe7eb5af2ccacf9fc1fc68292cad73236ff3f13b453369c42c45818a5f
SHA512

61134bb26a5f485894fc1c2deb9409ff9aa24dddccc0b43984d8c907ce83d80fc53864f59117497f7d2f3e3f89e6b134b41dae20dc8a3b4e800e5fb50247df5a
SSDEEP

24576:LCMB5OXFHe3qNljytok0PfNvj4XC/mtFsFwM7ug9A8mlM5ZvmCiC9CdU9r7btyU:eMB5O1uq+mnvV/9PzIMLvm6R9r7btyU

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2344	14d36fc4a50ce83ebd8dc8f0f039e115.exe
2344	14d36fc4a50ce83ebd8dc8f0f039e115.exe
2344	14d36fc4a50ce83ebd8dc8f0f039e115.exe
2344	14d36fc4a50ce83ebd8dc8f0f039e115.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2344	14d36fc4a50ce83ebd8dc8f0f039e115.exe
2344	14d36fc4a50ce83ebd8dc8f0f039e115.exe
2344	14d36fc4a50ce83ebd8dc8f0f039e115.exe
2344	14d36fc4a50ce83ebd8dc8f0f039e115.exe

C:\Users\Admin\AppData\Local\Temp\14d36fc4a50ce83ebd8dc8f0f039e115.exe
"C:\Users\Admin\AppData\Local\Temp\14d36fc4a50ce83ebd8dc8f0f039e115.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\A7258688\d1049614.dll

Filesize
571KB

MD5
ce51c613f3c22d013d966289dfdd7d70

SHA1
1bd5a4983999e998ca75ed477e57ce413979b8df

SHA256
5f66863129100ddf7cebf1538a75a1b8db25cf9dfa9fc863671c0a486047b472

SHA512
05999d9c0ddeb50aef4cbe448b76269248e997c12853d045e22b904bc6e4205464b859d34d517cef7bdf570c18e032d2b3fe28eea28678fbd765bed9dfa87565

Download Submit
\Users\Admin\AppData\Local\Temp\A7258688\f1060155.dll

Filesize
748KB

MD5
242d8d3615f4b4da84f603ab8c348919

SHA1
2aa2ebb5cd052dcb8d80529e0c01497d546d5792

SHA256
83f36405e6dd6abad284d1318d4ab3510a8a63c6f030ec4e5bcb6b92ae75678d

SHA512
e134dc4399a86f2d5ce6a971b8f771dacc2621e173bec13c94f2c05e17788160a302d35e4ed0d3fc32a27365305ea281b5cb459b81f5b85aa9140a16b224cc44

Download Submit
\Users\Admin\AppData\Local\Temp\A7258688\l1059227.dll

Filesize
278KB

MD5
17bddadca7044cc7b8406f1ca45210df

SHA1
d74c5236542f4ddbb50cd113dedcd05aa9861ca9

SHA256
4406dc1789f1ebdbfebb7796719d21dcce2250f3a0a07f204cfd0b4f93725f6c

SHA512
1abf4e41912e18b77f7e0ea7ce98e0a5760a554cf79c78dd8ccaf04589fc02579b0fbb5a822acf2d098c2362b778821b1e5e870a55cba5834566a723c0716d50

Download Submit
\Users\Admin\AppData\Local\Temp\nsy17E5.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/2344-19-0x0000000002880000-0x0000000002940000-memory.dmp

Filesize
768KB

Download
memory/2344-24-0x0000000002AC0000-0x0000000002B53000-memory.dmp

Filesize
588KB

Download
memory/2344-29-0x0000000002EA0000-0x0000000002EEF000-memory.dmp

Filesize
316KB

Download
memory/2344-61-0x0000000001D40000-0x0000000001D41000-memory.dmp

Filesize
4KB

Download
memory/2344-86-0x0000000002AC0000-0x0000000002B53000-memory.dmp

Filesize
588KB

Download
memory/2344-85-0x0000000002880000-0x0000000002940000-memory.dmp

Filesize
768KB

Download