Overview

overview

8

Static

static

3

388d1446ca...d9.exe

windows7-x64

7

388d1446ca...d9.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    0s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 13:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    388d1446ca00eefb1acf69280bc536d9.exe

  • Size

    84KB

  • MD5

    388d1446ca00eefb1acf69280bc536d9

  • SHA1

    6d1031c576c9457e8a6b5409928622f91201b221

  • SHA256

    bb5cb6ed65c820bd07a2c6cbfb33ecd32eb99311a80d6d62258068761066a661

  • SHA512

    aafc3d83283126a79996414e0433ddce15d098fc09c521817a43b758dbf764a20e35928ac4277897063fd63a1553a8e78a4ba84c753a22e39a1fc014b95d3b4e

  • SSDEEP

    1536:yiftS2sECvf75ggVKn4SeWF+JqNa/OTm7lKmPaUclT5fWrlJhWT8L1SpBNKDwT46:JS2sRTiiKnSzJwuOTLwFw5soT8IB4Dwz

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 12 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\388d1446ca00eefb1acf69280bc536d9.exe
    "C:\Users\Admin\AppData\Local\Temp\388d1446ca00eefb1acf69280bc536d9.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Users\Admin\AppData\Local\Temp\install.exe
      "C:\Users\Admin\AppData\Local\Temp\install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      PID:3064
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat" "
        3⤵
          PID:2716
      • C:\Users\Admin\AppData\Local\Temp\4BNB5.exe
        "C:\Users\Admin\AppData\Local\Temp\4BNB5.exe"
        2⤵
        • Executes dropped EXE
        PID:3056
        • C:\Windows\SysWOW64\cmd.exe
          /c del /f C:\Users\Admin\AppData\Local\Temp\4BNB5.exe.bak >> NUL
          3⤵
            PID:1192
          • C:\ProgramData\atshkbsd\wpqzgtyn.exe
            C:\ProgramData\atshkbsd\wpqzgtyn.exe
            3⤵
              PID:272
          • C:\Users\Admin\AppData\Local\Temp\loader.exe
            "C:\Users\Admin\AppData\Local\Temp\loader.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2216
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 88
          1⤵
          • Loads dropped DLL
          • Program crash
          PID:3048

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\loader.exe
          Filesize

          15KB

          MD5

          2d4523c5ad2afcc60883b68798383a97

          SHA1

          3da181e958cde4f1d93d60d38e9a82b14da60dab

          SHA256

          90d322eb71b867fcc4b6002ec8b8a23eebf0ce687f9665aea74e3852052ef932

          SHA512

          155bf04b4a7b1fac621c26bd896589730f569b4ffc1565f283751d999a3ac87b661b15f08a5e1d01b4ce18c11345e1e2d6df38096d103ff260a783fac009b9e1

          Download Submit

        • memory/3064-34-0x00000000002A0000-0x00000000002A9000-memory.dmp

          Filesize

          36KB

          Download

        • memory/3064-42-0x0000000000400000-0x0000000000414000-memory.dmp

          Filesize

          80KB

          Download