0e4c651aa1837f9dd5e0a5af273f6b55dddb3b9cdad49e9805471d91f2c1cfa0

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2024 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

netmap1.0/Setup.exe
Size

19.1MB
MD5

b7294dca30db45691b8579f3cfebd87a
SHA1

56405fc902ecf518b87ebd15ac891405919717ea
SHA256

fa5d0ba416aaf6c186dfc112d0c397bb48136484d5019588b3990f1b49fcfd23
SHA512

8b6c5866a832d98bb9492964b8f204e6fafb4df5d29fc40e00b8175733aa875d4a40cb6612424cdfe3d7bb5ec4632a42eba60f30aa659788455c84d9a8365630
SSDEEP

393216:d7KOXkLJ7Zda7B4BUI5JujpdZirjVbquD7bA785Ab/UcYlCG:d7fXstvaaBvgrZiXVWuDwI5A8X5

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1212	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\netmap1.0\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\netmap1.0\Setup.exe"
1⤵
- Loads dropped DLL
PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsw7001.tmp\InstallOptions.dll

Filesize
14KB

MD5
f62d03fcb1473110e920a9bb2c701006

SHA1
c48444ef2daa60dcdf91f1645cd4ecd8e66545f7

SHA256
17e2f205af12d5a86638dc83c95fc69199c41af2fa6daeb1e91ec330f68c5372

SHA512
701d531d405d08054d53298141d5bbd56e74df7b22bcea5f9f0e5c4407421ea0ca9617aa84e740dc1dc44e6d14e58852c1ca2087213cc2319f2da44eaed0bc05

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw7001.tmp\ioSpecial.ini

Filesize
634B

MD5
41c969c1a50d8eac3f6033dbe29f2b82

SHA1
db007df9340b124aa9fc50f0b74e588388513a89

SHA256
1012e3ae3bba3da783dac53f92235076b3621f231fee0ef0c945bcc6d63c87a1

SHA512
133d4ff7b4fbabee6e098e8dc834c4f1605959109e7404bece8bdc11477790a11fe9e2a3db8c78f3f7f3e5d53e7f21e1171077332d9742a691b1b022da3514a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw7001.tmp\ioSpecial.ini

Filesize
595B

MD5
57e41d4765816234c1769a8884d01e16

SHA1
bb02e3934feeda449ecdf4c072cd6ed50ca78591

SHA256
b34a93774f44118575e55cfa0c68289b1f95563e079ef95da1db98cc83636cc6

SHA512
620b2260b5ff065d07834597491077158703eb18e4edeb8faea3db636b86d1bbe9fc951a807fe06a6358b4d17545608a65cddb8ebfa02763470cb2b6c21fca05

Download Submit