74f3138036e7fac6464e48b866197afc56d80b3bfa9c1944d3226258ec49492a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 05:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

15364923bbeeffbc51b7592f97030bcc.exe
Size

17.2MB
MD5

15364923bbeeffbc51b7592f97030bcc
SHA1

5c5d6af10bd1ab99b926770c23613b8ff88a7f6c
SHA256

74f3138036e7fac6464e48b866197afc56d80b3bfa9c1944d3226258ec49492a
SHA512

4480b6f8447cffde464c6ee2c02b795c6a52398bc2a91ec0f087f797a17bdacf87b1293dfa6c990e5faa07b420fdba5857862f9b9067c74b4aee90adb8ff4d36
SSDEEP

393216:mgIylbDWeXz9Jg8WBJWvVPtMkwek5VJFvXZ6:MyVSrBJKPtOn5zFx6

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1740	Windows.exe

Loads dropped DLL 2 IoCs

pid	Process
2912	15364923bbeeffbc51b7592f97030bcc.exe
1740	Windows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 1740	2912	15364923bbeeffbc51b7592f97030bcc.exe	28
PID 2912 wrote to memory of 1740	2912	15364923bbeeffbc51b7592f97030bcc.exe	28
PID 2912 wrote to memory of 1740	2912	15364923bbeeffbc51b7592f97030bcc.exe	28

C:\Users\Admin\AppData\Local\Temp\15364923bbeeffbc51b7592f97030bcc.exe
"C:\Users\Admin\AppData\Local\Temp\15364923bbeeffbc51b7592f97030bcc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\Windows.exe
  "C:\Users\Admin\AppData\Local\Temp\15364923bbeeffbc51b7592f97030bcc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\Windows.exe

Filesize
1.9MB

MD5
a43db76a1faec75b2b1c0448d25b7130

SHA1
4a7331fd190389a25009ddf7fe4dd86b45ca8fa3

SHA256
53f09f70fb9fecc307dd83824bb1a109a8e37b55f739a28289c6e6bf74cf6a3e

SHA512
ae4521e63ca42cb99028771a4a83cdb675103d26b6522706520931cf73c32662e17ab23ad01cc91fbf3a46c024800ecb710263b442d9efc8a44209f2febcad01

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\python310.dll

Filesize
1.5MB

MD5
58b119b88fc62b8ee6535c615ce15d64

SHA1
4dda1511714bbf35e5d72c4e4872b8b46e37c316

SHA256
0ccd8d80c79d3b23c985955d6c025ad1f3e9a18d2d88e9815701ad02874d0820

SHA512
18c38e0259feb26fd406a4b978c6b8fc180f4c6a0c83759e464f641ba771db20c383729de401fb778db9d6406c993b2d57e516a62803e65808ad308c0b58f299

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\Africa\Banjul

Filesize
148B

MD5
09a9397080948b96d97819d636775e33

SHA1
5cc9b028b5bd2222200e20091a18868ea62c4f18

SHA256
d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997

SHA512
2eccf2515599ed261e96da3fbcfbab0b6a2dfc86a1d87e3814091709f0bfe2f600c3044c8555ed027978a8ae9045666ee639a8c249f48d665d8e5c60f0597799

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\Africa\Djibouti

Filesize
265B

MD5
86dcc322e421bc8bdd14925e9d61cd6c

SHA1
289d1fb5a419107bc1d23a84a9e06ad3f9ee8403

SHA256
c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968

SHA512
d32771be8629fb3186723c8971f06c3803d31389438b29bf6baa958b3f9db9a38971019583ba272c7a8f5eb4a633dfc467bfcb6f76faa8e290bad4fd7366bb2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\Africa\Kigali

Filesize
149B

MD5
b77fb20b4917d76b65c3450a7117023c

SHA1
b99f3115100292d9884a22ed9aef9a9c43b31ccd

SHA256
93f19e9551d58868ae5820752d2c93a486124c364463dc9c9489d0458f8bc682

SHA512
a088c2a4c7d72717257c3125c7c2aca28463d68306ea452afaad75b8a0f9e5730a8d9c430d14668809717a672dc63c4816762acb046b339da662da421a6d65df

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\Africa\Lagos

Filesize
235B

MD5
8244c4cc8508425b6612fa24df71e603

SHA1
30ba925b4670235915dddfa1dd824dd9d7295eac

SHA256
cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846

SHA512
560c7581dcb2c800eae779005e41406beaf15d24efc763304e3111b9bb6074fe0ba59c48b5a2c5511245551b94418bbc35934d9bd46313fcc6e383323056668c

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\America\Curacao

Filesize
246B

MD5
adf95d436701b9774205f9315ec6e4a4

SHA1
fcf8be5296496a5dd3a7a97ed331b0bb5c861450

SHA256
8491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497

SHA512
f8fceff3c346224d693315af1ab12433eb046415200abaa6cdd65fd0ad40673fdddf67b83563d351e4aa520565881a4226fb37d578d3ba88a135e596ebb9b348

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\America\Toronto

Filesize
3KB

MD5
44a2dd3cb61b90aa4201c38e571a15ba

SHA1
73f6ad91b2c748957bdaec149db3b1b6b0d8ac86

SHA256
820392cdb1e499f82ef704d0ccfd0c50ab2b28c6e0bdeb80793861d5e165d5ad

SHA512
11ddb971c65c2f4ecc690ef685163f2972c089660f4778997964d89113a403030927edbb2ed397b81cf61bde9276add6a43ee8ee92dfa69a6d102b035fe9f01d

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\Asia\Shanghai

Filesize
561B

MD5
09dd479d2f22832ce98c27c4db7ab97c

SHA1
79360e38e040eaa15b6e880296c1d1531f537b6f

SHA256
64ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6

SHA512
f88ae25f3f04c7d5d5f98aafecc03cc7e4e56f1cd4c8deba6afd043f0fb7fe67b4d50e4df5493e77c6b34ba183e019442e736a13f784ba8c2847c06fd74ff200

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\Etc\UCT

Filesize
114B

MD5
38bb24ba4d742dd6f50c1cba29cd966a

SHA1
d0b8991654116e9395714102c41d858c1454b3bd

SHA256
8b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2

SHA512
194867d0cf66c2de4969dbfeb58c775964ecb2132acdc1b000b5ef0998cefde4a2979ffc04ec8b7dcb430e43326a79d9cedb28ecea184345aa7d742eaf9234ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\Europe\Isle_of_Man

Filesize
3KB

MD5
a40006ee580ef0a4b6a7b925fee2e11f

SHA1
1beba7108ea93c7111dabc9d7f4e4bfdea383992

SHA256
c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4

SHA512
316ecacc34136294ce11dcb6d0f292570ad0515f799fd59fbff5e7121799860b1347d802b6439a291f029573a3715e043009e2c1d5275f38957be9e04f92e62e

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\Europe\Oslo

Filesize
2KB

MD5
7db6c3e5031eaf69e6d1e5583ab2e870

SHA1
918341ad71f9d3acd28997326e42d5b00fba41e0

SHA256
5ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701

SHA512
688eaa6d3001192addaa49d4e15f57aa59f3dd9dc511c063aa2687f36ffd28ffef01d937547926be6477bba8352a8006e8295ee77690be935f76d977c3ea12fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\Europe\Skopje

Filesize
1KB

MD5
6213fc0a706f93af6ff6a831fecbc095

SHA1
961a2223fd1573ab344930109fbd905336175c5f

SHA256
3a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a

SHA512
8149de3fd09f8e0f5a388f546ffe8823bdcda662d3e285b5cebc92738f0c6548ccb6ed2a5d086fd738cb3edc8e9e1f81c5e2e48edb0571e7ea7f131675b99327

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\Greenwich

Filesize
114B

MD5
9cd2aef183c064f630dfcf6018551374

SHA1
2a8483df5c2809f1dfe0c595102c474874338379

SHA256
6d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d

SHA512
dafa0cb9d0a8e0ff75a19be499751ad85372aafa856ff06dd68ecf2b1c5578bb98a040becaecf0aed2c3e4ff7372ff200fe7614334756d19fe79dd61c01d4e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\Pacific\Wallis

Filesize
152B

MD5
5bdd7374e21e3df324a5b3d178179715

SHA1
244ed7d52bc39d915e1f860727ecfe3f4b1ae121

SHA256
53268a8a6b11f0b8e02fc67683ae48d074efaf7b4c66e036c1478107afd9a7d7

SHA512
9c76f39e8795c50e6c5b384a7ff1f308a1c5173f42f810759b36cdeae7d33d1dac4934efeed580c59d988c152e2d7f8d9b8eb2073ab1fc15e4b9c10900c7b383

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\pytz\zoneinfo\Pacific\Yap

Filesize
172B

MD5
ec972f59902432836f93737f75c5116f

SHA1
331542d6faf6ab15ffd364d57fbaa62629b52b94

SHA256
9c1dfa1c15994dd8774e53f40cb14dcf529143468721f1dba7b2c2e14ae9f5f0

SHA512
e8e8c8f6d096c352d1244280254e4c6ecf93f7c2ff69ecc6fa4363a6be8a2daf6cfcd7f0d96bc2669268ced5565532fa06be348a139b0742ccccb83953c6324d

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\Windows.exe

Filesize
2.8MB

MD5
2d5cd6506c71538526cf4ec5d429b41e

SHA1
f562585fa5e90c45badbf9315939c153ba66e098

SHA256
0e94b165635fa891ea27819d60108422096208b86f724ec05f9e1abbf9ac147b

SHA512
725cc3cbf1761ca864fdfabf34ede3710033db1f833a1c2004435e599087334bc805370d878cf2d33e22903edc06aebcfd0069b210c88ae7e1a8e225c498e128

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2912_133495987203954000\python310.dll

Filesize
1.7MB

MD5
22ff00f68a620390f2a17fea3ed38416

SHA1
5b9b13b01555b62e4796651319c93a45a7dc7671

SHA256
14d5ad096dbf960665da13aaf4701b0597db79d5fc9a9e9c08409a4fb1a22a36

SHA512
892781652d25864cd6f6590b969c078709fe3fc936032cb9d340fb686de2445de6116e41f3faa349ea8cdeaaded8cb8301a75616f92264b98ceddbd3e4c546df

Download Submit
memory/1740-667-0x000000013F4F0000-0x000000014178A000-memory.dmp

Filesize
34.6MB

Download
memory/2912-684-0x000000013FA80000-0x0000000140BCE000-memory.dmp

Filesize
17.3MB

Download
memory/2912-686-0x000000013FA80000-0x0000000140BCE000-memory.dmp

Filesize
17.3MB

Download