6e95aeb33d6452681c95ef8a96a4302c8dea8a320b7e438f1407cb074520f880

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5401ac54f4f8e9b06a95acde38cc948d.exe
Size

1.2MB
MD5

5401ac54f4f8e9b06a95acde38cc948d
SHA1

2081f30052f050fa4d0341b4c9e27aa665361449
SHA256

6e95aeb33d6452681c95ef8a96a4302c8dea8a320b7e438f1407cb074520f880
SHA512

364d2ada2735f6ee1b56c0889059b0d443ccbf6053ce68b0a2da8c67236953c948a2ada4163d16216bf7085107b4480e760d684003afce4f8c86db3ac79927c3
SSDEEP

24576:BQNb0GdakEWrkV9MbU/evUhWzyiYF06fhX/Nj/EFLWnaQt6tjpxorapy:WNb0hkEWrKMbU/CUhWK0EvNj/h5Wxor9

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2912	5401ac54f4f8e9b06a95acde38cc948d.exe
2912	5401ac54f4f8e9b06a95acde38cc948d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2912	5401ac54f4f8e9b06a95acde38cc948d.exe

C:\Users\Admin\AppData\Local\Temp\5401ac54f4f8e9b06a95acde38cc948d.exe
"C:\Users\Admin\AppData\Local\Temp\5401ac54f4f8e9b06a95acde38cc948d.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstBE5.tmp\ioSpecial.ini

Filesize
699B

MD5
f83a4da51bf461ea85d974a98d5ff737

SHA1
33abc227ecba3973a245dccfe7c4b759e2413b13

SHA256
2edb8935086626a8418cc385e1a89773a0882cac478837851c36666a55be032b

SHA512
136f8bb3f3f6eb13bdaaf0c2b579b52775600357de31638d5dcf4c2dfbcb2b63a7178127384acda0ce25238cbf5d9fd566ccd3f98ca803eb8f8c83d29ab58b81

Download Submit
\Users\Admin\AppData\Local\Temp\nstBE5.tmp\InstallOptions.dll

Filesize
14KB

MD5
32aa6334fc543e70ef0f792bb9a0c45a

SHA1
54be1f5004f7e5afe7c9ba160495076ea2a4d60c

SHA256
610e54bcfc2831d4f9d7030ceb16d35ee33006403d842f01b6e75bebea0083e2

SHA512
ac92116821a032de8df64bf9aea9c6ba4040467eebaa4e028c2bf031f1c81bb69531288b9d89d951b952fe0b4ecccade874a5ae76d04db8b4dee2d13c486f9ae

Download Submit
\Users\Admin\AppData\Local\Temp\nstBE5.tmp\LangDLL.dll

Filesize
5KB

MD5
51e7fd0885b7d7bf6edc030e17145950

SHA1
be7a62d254f897789cde5b9a77a8b3b0add6d141

SHA256
1a56dfe0bdae779b40d11b9caee5c96e81b9d69b0d45be7c7b11717e1db8c5a5

SHA512
a57c57a3d01839df10ab669bead1d757ef85e4a35cac65a3a147c5e1adaccaae52bb355ed8d4d460a6698cbda3ee8fba395875739670c8cf57884f66306d011a

Download Submit