eb4f337d768325651d5961cf1a435498fc697469e19f0d2af12f256da97b108d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

38e3dba8acac7201d082461ce131ed8e.exe
Size

1.2MB
MD5

38e3dba8acac7201d082461ce131ed8e
SHA1

ae894eb440af341211939059b63de2db4f60330c
SHA256

eb4f337d768325651d5961cf1a435498fc697469e19f0d2af12f256da97b108d
SHA512

0ff8592200507f233da69696d60f5d6775f3d82bebc0820fe71457304d1df55de5b39883d93574d71082b075d2d1405ff92a0e7006df32900f23e913e46f5f4f
SSDEEP

24576:v2zC9V6Ci1ti3/lqtcQ13k+2yEAjvm04qyeliqWW4blrRoVawr4rJj:vhv6CD3/k2Q3kLAjvFJ+ZW4blttrJj

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2428	38e3dba8acac7201d082461ce131ed8e.exe
2428	38e3dba8acac7201d082461ce131ed8e.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	38e3dba8acac7201d082461ce131ed8e.exe
File opened (read-only)	\??\B:	38e3dba8acac7201d082461ce131ed8e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\38e3dba8acac7201d082461ce131ed8e.exe
"C:\Users\Admin\AppData\Local\Temp\38e3dba8acac7201d082461ce131ed8e.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~vis0000\English.vlg

Filesize
13KB

MD5
aa00f72bfc4b20e2ef89a6d705c19345

SHA1
965362d97bc6e19a711d7730ec1a76ff2400508f

SHA256
ada22eb8e66b404689fabf256e185dd0a9005b7bc7e6c616db27ed7dbec080a5

SHA512
458d4da6b853b6561b0777817b77f8b073e6e3c7d63bd4ea99117e06d8dc79d02ccaf17d410ad4d2819fcddd2bfd78b2152ff502c03efb14299320733a19c358

Download Submit
\Users\Admin\AppData\Local\Temp\~vis0000\jpeg.dll

Filesize
104KB

MD5
0da8449291b80aac6c6f7e356d14ba36

SHA1
421456596c690b69d262dcb5e96f474c3c92ab14

SHA256
c83e2f98b9182073002b24c731f9fe0512bc4a3b468181c677d20fc465218232

SHA512
4e99332b791a7629d8541fce0e3d56d3452168abbbe5e56e38d79edb440bf1e12ca2d73d2f79d78a5c2ba282ab3ff84103691153fe26da670e9a9a28f75713ac

Download Submit
\Users\Admin\AppData\Local\Temp\~vis0000\vise32ex.dll

Filesize
528KB

MD5
54925d8aea245a7be34ec34402b2865b

SHA1
b16784c092f1198c8ebf76d734faa057a402613b

SHA256
ee0d08a2b5888b1e127f11fee8bf91d274e4126d571c62654b97270a11be7c0f

SHA512
616170f44457cfc35e3428de427f6fe3e8f3c97400db0f0c0fc70dad23571a5abb8cf988ef46c31bdfcc2f4e62dbda435b5d2f3646a4f934a344fa4127b8b5c6

Download Submit
memory/2428-52-0x00000000003D0000-0x00000000003EB000-memory.dmp

Filesize
108KB

Download