cabfcaa989acc2533743eecfeb4eaa25827c2d196062ffc2f18f8f4a252836f0

Analysis

max time kernel
147s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2024 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CLodop_Setup_for_Win32NT (1).exe
Size

4.8MB
MD5

eac342a26a394ecdcf95e668121f6526
SHA1

c5ee45d5cd506dc330dde8de3779dc83bf286400
SHA256

81b89cc0b3659c6e250b5ecf6b86d3e8ccba14cda64e51e7b8dc1747113ef4ef
SHA512

cef1db2ba9bc37092d92e33d5cd84ab26e7e0cb850df5f10a890e9f1ee9a553f0c8a3cd3d3f6031e471832133d596fb6556166f2c6359cdf6286a53d361ff805
SSDEEP

98304:B8rncyS3dIni7LRfs5BrYMCmaIoieRoXFF27l4qSdzhvcWg+QSC:Grn+3dbu52MAiDF64RxhkRbSC

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1508	is-MP6HB.tmp

Loads dropped DLL 2 IoCs

pid	Process
1508	is-MP6HB.tmp
1508	is-MP6HB.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1508	is-MP6HB.tmp
1508	is-MP6HB.tmp
1508	is-MP6HB.tmp
1508	is-MP6HB.tmp
1508	is-MP6HB.tmp
1508	is-MP6HB.tmp
1508	is-MP6HB.tmp
1508	is-MP6HB.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1508	2096	CLodop_Setup_for_Win32NT (1).exe	88
PID 2096 wrote to memory of 1508	2096	CLodop_Setup_for_Win32NT (1).exe	88
PID 2096 wrote to memory of 1508	2096	CLodop_Setup_for_Win32NT (1).exe	88

C:\Users\Admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT (1).exe
"C:\Users\Admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\is-9F9D4.tmp\is-MP6HB.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9F9D4.tmp\is-MP6HB.tmp" /SL4 $F0044 "C:\Users\Admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT (1).exe" 4701871 51200
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-9F9D4.tmp\is-MP6HB.tmp

Filesize
646KB

MD5
79551e7f460ce4a92b6c9c0f0b714108

SHA1
51c8cd3741482a00ee6137822f826c0f55d521c4

SHA256
06ae7abcec424f92569cd67e55e27c7e91f84f6108f91876cd3f135262341bef

SHA512
4e1d7bc491d21064d89414aa335915d306ea3e811d7fe237c9e111b0588189d8d37b238b7ff39159b05125eaee6637956a7f0f8e2ae51a7a5196765af62665a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M1TGA.tmp\TaskDll.dll

Filesize
130KB

MD5
3a57389802e43a5bc4f13e99742c218e

SHA1
a070a8d60e85850d85ad650b90ff3afb8ebf6803

SHA256
25cd485dd2a9e692637a6860ed3f75f810d8883781d169ee4954170fb800dca6

SHA512
c131caed5786cbb4d1c3c31761314676eea6eda2daf42337edb306ea36ed791fc8ae6dff4a7f47eb5182dd1db0c5f30c66a1ca5dadf98d5337c340e8137bff20

Download Submit
memory/1508-7-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1508-17-0x0000000003A30000-0x0000000003A5C000-memory.dmp

Filesize
176KB

Download
memory/1508-21-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1508-22-0x0000000003A30000-0x0000000003A5C000-memory.dmp

Filesize
176KB

Download
memory/1508-26-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2096-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2096-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2096-20-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download