9374ddce01ef128b4e6dcb4baf7de1bf4b17024ff58fbb9fd2c01f9cebd6fbaf

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48efac186e9b13c293153629f60376d8.exe
Size

1.1MB
MD5

48efac186e9b13c293153629f60376d8
SHA1

4fde6f0e4833e3812a71e0dd2f99cb6f3a13de3d
SHA256

9374ddce01ef128b4e6dcb4baf7de1bf4b17024ff58fbb9fd2c01f9cebd6fbaf
SHA512

c4dea4b30522ba4e37ae3e0a108d42fdee04bb0eccbd7cde1dc071e2b400bdcf2855dc62be2866649f60aa82c6b49f203b02d9d19ab216ffa294228da29d3aa5
SSDEEP

24576:LqaAReuFqacorBTmC8PimgAKeeiRiovQJS2Lxzy9bStwcDbdiQZi4qO:LbAReuRc2ePLKAlepYEwZQuO

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1016	48efac186e9b13c293153629f60376d8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1016	48efac186e9b13c293153629f60376d8.exe

C:\Users\Admin\AppData\Local\Temp\48efac186e9b13c293153629f60376d8.exe
"C:\Users\Admin\AppData\Local\Temp\48efac186e9b13c293153629f60376d8.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst48D4.tmp\ioSpecial.ini

Filesize
726B

MD5
dda339b51a9ba51951721b8e5af72260

SHA1
9382f87582aca4451e9718fbd6c51737e789255f

SHA256
bb517ea72f8fccd908617bbbe0d74463352d2212e15b78020467ffec3493fe37

SHA512
6391666a5f2ed9d01dd36ae322e229f4e97ea46775c67fb13cf46e1396020f46f88f384495f67fcb9eb3f2a977a92d271e184fc7c7bd14f691241d502865b134

Download Submit
\Users\Admin\AppData\Local\Temp\nst48D4.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit