05103e06fa660ee043c3ccf313e3fa6586a9fa752ae448bdb6ae2e707781f71c

Analysis

max time kernel
161s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
27d3cdc0a2145ef51acf0c11b82d0d1e.exe
Size 327KB
Sample231231-ewpdjsbgb5
SHA256 05103e06fa660ee043c3ccf313e3fa6586a9fa752ae448bdb6ae2e707781f71c
MD5 27d3cdc0a2145ef51acf0c11b82d0d1e
SHA1 759fb37e7fb839849bc0cc37b2798a2abbfce2e8
SHA512 08ab69f9227e6d3ce42cad73466463af4f571eceeba1f17d702a8da23f5e7971f20d2c59f2b03f32aec32dba49bc7ce3417c2e0b65478d65be20e3acbdd90628
SSDEEP 6144:Jr469uEo2S1YnQmCX492DkwNP3qpYFGgjwuBGVdLAt4ZHd2i3gjd+ZD/6FL:Jr4iu6/eIo4Rsw33AtsmQ+
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2108	27d3cdc0a2145ef51acf0c11b82d0d1e.exe
2108	27d3cdc0a2145ef51acf0c11b82d0d1e.exe
2108	27d3cdc0a2145ef51acf0c11b82d0d1e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	27d3cdc0a2145ef51acf0c11b82d0d1e.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	27d3cdc0a2145ef51acf0c11b82d0d1e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2108	27d3cdc0a2145ef51acf0c11b82d0d1e.exe
2108	27d3cdc0a2145ef51acf0c11b82d0d1e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 748	2108	27d3cdc0a2145ef51acf0c11b82d0d1e.exe	95
PID 2108 wrote to memory of 748	2108	27d3cdc0a2145ef51acf0c11b82d0d1e.exe	95
PID 2108 wrote to memory of 748	2108	27d3cdc0a2145ef51acf0c11b82d0d1e.exe	95

C:\Users\Admin\AppData\Local\Temp\27d3cdc0a2145ef51acf0c11b82d0d1e.exe
"C:\Users\Admin\AppData\Local\Temp\27d3cdc0a2145ef51acf0c11b82d0d1e.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin7053.bat"
  2⤵
  PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.ini

Path C:\ProgramData\InstallMate\8BBAF8A2\cfg\1.ini
Size 1KB
SHA256 256e3e7cafa4872581e56b9072256f644c3213c92a47286630370c500e980249
MD5 4bcaf61aa53c70720d3ff40c20b6fc30
SHA1 feb3fcbec8976073ac9c0feefb1e7662c4baaa69
SHA512 09db7756fa1df8f350590a207ae61e662c334d9af201438f9770d9c83faaac39c9a66ede329aff9c02b6224248fda663331d4b9ff573575cf18bde4dcdf739d0
MD5 SHA1 SHA512

Submit Download

TsuE6700C93.dll

Path C:\Users\Admin\AppData\Local\Temp\TsuE6700C93.dll
Size 242KB
SHA256 a22afdfc9d4f221dc3b469927759e9c0a8b73806c7b4ea59b3b332803b68f50e
MD5 aea05499ef427dbf757229571e2cf793
SHA1 07b9552aa70894111e1423f4f6f5ee099abea23a
SHA512 7dfb72667d543e5001ab0ef4844f80ee244599e37494d0b3013920bbebf9845fb0b854d2b5c09b6387c98bd8457a1aa3e6fd16043ed0e2124e8d6c06df632c25
SSDEEP 3072:Nq0f8G5dLmq+wpZoOcfAftBDz1jQr6aslH7bOOsKFNRrICDX5TMo27diIIPzxyLJ:N/rdStrfAftBVju6v+UvrBhMo27dOQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

TsuE6700C93.dll

Path C:\Users\Admin\AppData\Local\Temp\TsuE6700C93.dll
Size 62KB
SHA256 d386219da46a46539b5917ba08b11b268eabe2d7de1684f0176c2f4eaf3da837
MD5 eeb413137f496af9ee358f31111579a9
SHA1 e73ece2a215a0e20e9cbe1b9d4ae179a5a5cb1ec
SHA512 da85f8dc89148ce8eb7defe6d768a430ab6dc22d34921b81f68762431b553e8b4858006e0ef901c9ade7909ddd8d15686ac9694b519423cfbe92217c2fa7d619
SSDEEP 1536:NRFsfRKtl8bq5dLmcrHeRCpZGTOiy61DTAf25i:Nq0f8G5dLmq+wpZoOcfAf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

_tin7053.bat

Path C:\Users\Admin\AppData\Local\Temp\_tin7053.bat
Size 50B
SHA256 52a3ff77f06d2212e598790f95b73e86d4983e61989bb343c87b45261784c188
MD5 e1e046523c2c7c297eeb3f7ed7d96dbf
SHA1 e0a068de6402d6cb8c1bb36301f66164e523dd9e
SHA512 62e3ce4589144abc6be48bb70ee2a9feff948f28b06d4dfc41433cfb3f0998fea82caae02f2ffa018d864c4ad24e188b9e811896e9025e68b3acd023790941e4
MD5 SHA1 SHA512

Submit Download

Custom.dll

Path C:\Users\Admin\AppData\Local\Temp\{AEF64203-5F3C-4724-A5CF-171E751560F5}\Custom.dll
Size 77KB
SHA256 35aa61441d104921db0c52a25d73430d56aed753dc628984f5ecf3b234c94fa4
MD5 b4f1ce718f77574bc08004ef7afcb3d7
SHA1 ecd7cf42b601c44caf983de7caa3bdabce36501c
SHA512 b01d16982ce032854fe42073eea46e6e20005a56cd218fabe92093ecd30c8f764711eaf6dcc972b90db749d7fa7ad56a28e98a76df5b584197bbda4e657992b6
SSDEEP 1536:K7xcx/juCKV+hVboYrEhySESy9GNGU6u1Go6eOYM++vp:K7qxa8NoYr6w5S8o6epM++vp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Readme.txt

Path C:\Users\Admin\AppData\Local\Temp\{AEF64203-5F3C-4724-A5CF-171E751560F5}\Readme.txt
Size 2KB
SHA256 44e596d17ddd82458ac70f4349fc30a2edfde5a1438de162cba2b4185a06d44c
MD5 cdb83c5f8ef48383f7db8f186d98f7bd
SHA1 2b47e6d7af95c7e50e517950bc0e552e5ab4f388
SHA512 0f1c5f65925b8e42c1bb1403e32e0d25801cc3ecd98e2dda1626699d54aad68ad608316bb16cb140c21d8caf82f8f376d2eeb5016927c734bfd914cdab8c1373
MD5 SHA1 SHA512

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\{AEF64203-5F3C-4724-A5CF-171E751560F5}\Setup.exe
Size 1KB
SHA256 8422ad8603907b7d46ec22db0341f1cf34a744a24f0c1f97053ad9aa9869334e
MD5 f922d404e3715de28ff14cfdb20d5eaa
SHA1 50e17b742702bfd4ac32b08bc3b46536c8a81255
SHA512 93ca42a602502c55cf87c160eac81f76b92c7a1fc617187e46f5b3e5968c160a9fdbdec56ec4e8aa824f8317a13e9f531617287979ca72dc9d298b33203ddab4
MD5 SHA1 SHA512

Submit Download

Setup.ico

Path C:\Users\Admin\AppData\Local\Temp\{AEF64203-5F3C-4724-A5CF-171E751560F5}\Setup.ico
Size 14KB
SHA256 dddc311ded9236e2c582d9df11639b8119c2d9265799f225d9efb047c9f3118a
MD5 fd7ffd6a90536af8391733e3695e3740
SHA1 6774868b160ec653a594a8c29ebc5c432a6615bb
SHA512 3279d7277d587df6c20ddccb487a24fb2cd41f88b701a93b1166bb8f3653b752509fd675858ccf12d7c47fea6b82c2e201e96bc54500b76fd9a6169681527638
SSDEEP 192:9t9gfii6ii2h4wnMdrzhQ9G1kqpqOxbypDxaCRLmi/pcWF7RPRBCzLe28jkLgRUY:FenwtspggKiB57RsKRWx2
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Setup.dll

Path C:\Users\Admin\AppData\Local\Temp\{AEF64203-5F3C-4724-A5CF-171E751560F5}\_Setup.dll
Size 10KB
SHA256 3ffee40102f3aaa939556f51dffa443e6976f4c09fac28a30d65e2907c295b91
MD5 098f90b30485a3d434a88d48983cbe0e
SHA1 29c1d7f827dd66f531b7e24dfcd477c626c89779
SHA512 ab91c32b250963179d104347803708f4d69f8ce612078fa31f89a45d8be643485e22e7b083554e9ce03ae56d1aa22de489963465fbaf5a1c10da6b5a5b6e6db7
SSDEEP 96:DyHRIjL7NtlhoFYo4I+m2GWmPnnnnnnnMaKXH1Bi5lIEp:yRatseXNPP8nnneYia
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Setup.dll

Path C:\Users\Admin\AppData\Local\Temp\{AEF64203-5F3C-4724-A5CF-171E751560F5}\_Setup.dll
Size 34KB
SHA256 fa2f27181a6cf14cb8e3f524679f55afe160b5f53c88e0e9b81573b3ce8d5cfd
MD5 530ae5927103176db29d88cc63fc2746
SHA1 0e32fef2897f3e5184b3ff2f70c1b15c372a7adc
SHA512 ad93b4755fec9cd6a900c850f215acd25104a1a48715b818708b0058ee199e82374f0e3d19e55c7062517ffd508eccc4aa4157b376ebd29e732b10827f6016d3
SSDEEP 384:mQset0nGenwtspggKiB57RsKRWxmpWrP3RRm3rxLSkw:mQPWfwtG9B57H8/oW
MD5 SHA1 SHA512 SSDEEP

Submit Download