cabfcaa989acc2533743eecfeb4eaa25827c2d196062ffc2f18f8f4a252836f0

Analysis

max time kernel
249s
max time network
285s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-01-2024 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CLodop_Setup_for_Win32NT (1).exe
Size

4.8MB
MD5

eac342a26a394ecdcf95e668121f6526
SHA1

c5ee45d5cd506dc330dde8de3779dc83bf286400
SHA256

81b89cc0b3659c6e250b5ecf6b86d3e8ccba14cda64e51e7b8dc1747113ef4ef
SHA512

cef1db2ba9bc37092d92e33d5cd84ab26e7e0cb850df5f10a890e9f1ee9a553f0c8a3cd3d3f6031e471832133d596fb6556166f2c6359cdf6286a53d361ff805
SSDEEP

98304:B8rncyS3dIni7LRfs5BrYMCmaIoieRoXFF27l4qSdzhvcWg+QSC:Grn+3dbu52MAiDF64RxhkRbSC

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
596	is-D8J9P.tmp

Loads dropped DLL 4 IoCs

pid	Process
3008	CLodop_Setup_for_Win32NT (1).exe
596	is-D8J9P.tmp
596	is-D8J9P.tmp
596	is-D8J9P.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
596	is-D8J9P.tmp
596	is-D8J9P.tmp
596	is-D8J9P.tmp
596	is-D8J9P.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
596	is-D8J9P.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 596	3008	CLodop_Setup_for_Win32NT (1).exe	27
PID 3008 wrote to memory of 596	3008	CLodop_Setup_for_Win32NT (1).exe	27
PID 3008 wrote to memory of 596	3008	CLodop_Setup_for_Win32NT (1).exe	27
PID 3008 wrote to memory of 596	3008	CLodop_Setup_for_Win32NT (1).exe	27
PID 3008 wrote to memory of 596	3008	CLodop_Setup_for_Win32NT (1).exe	27
PID 3008 wrote to memory of 596	3008	CLodop_Setup_for_Win32NT (1).exe	27
PID 3008 wrote to memory of 596	3008	CLodop_Setup_for_Win32NT (1).exe	27

C:\Users\Admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT (1).exe
"C:\Users\Admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT (1).exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\is-M685L.tmp\is-D8J9P.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-M685L.tmp\is-D8J9P.tmp" /SL4 $5015A "C:\Users\Admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT (1).exe" 4701871 51200
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-KCAF3.tmp\TaskDll.dll

Filesize
130KB

MD5
3a57389802e43a5bc4f13e99742c218e

SHA1
a070a8d60e85850d85ad650b90ff3afb8ebf6803

SHA256
25cd485dd2a9e692637a6860ed3f75f810d8883781d169ee4954170fb800dca6

SHA512
c131caed5786cbb4d1c3c31761314676eea6eda2daf42337edb306ea36ed791fc8ae6dff4a7f47eb5182dd1db0c5f30c66a1ca5dadf98d5337c340e8137bff20

Download Submit
\Users\Admin\AppData\Local\Temp\is-KCAF3.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-M685L.tmp\is-D8J9P.tmp

Filesize
646KB

MD5
79551e7f460ce4a92b6c9c0f0b714108

SHA1
51c8cd3741482a00ee6137822f826c0f55d521c4

SHA256
06ae7abcec424f92569cd67e55e27c7e91f84f6108f91876cd3f135262341bef

SHA512
4e1d7bc491d21064d89414aa335915d306ea3e811d7fe237c9e111b0588189d8d37b238b7ff39159b05125eaee6637956a7f0f8e2ae51a7a5196765af62665a8

Download Submit
memory/596-9-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/596-20-0x00000000007B0000-0x00000000007DC000-memory.dmp

Filesize
176KB

Download
memory/596-22-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/596-23-0x00000000007B0000-0x00000000007DC000-memory.dmp

Filesize
176KB

Download
memory/596-30-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3008-1-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3008-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download