d4f203940ef19ff6f326aef63563661d2906ee36b824d746463195920fa2c6b8

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.FileRepMalware.861.exe
Size

860KB
MD5

2916dea2c010569641e5833fa8bbfc72
SHA1

9495ba774af941ef0813a29a37782497c592bd4e
SHA256

d4f203940ef19ff6f326aef63563661d2906ee36b824d746463195920fa2c6b8
SHA512

9233858dbdaff0841fc72c853ff93e71c562b840484238240982716e3baa9ce29336698efceef5e982cd35d40bbbdfad11d3969cabcf4842c5f4b6d85ed24c0d
SSDEEP

24576:PToSKqZ1GzhYfDNHoa3cPm3sHOcC1hF8C8:PTWGMzhSJHoasPmsHOcC18C8

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3148	SecuriteInfo.com.FileRepMalware.861.exe
3148	SecuriteInfo.com.FileRepMalware.861.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.861.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.861.exe"
1⤵
- Loads dropped DLL
PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsa6DAF.tmp\InstallOptions.dll

Filesize
15KB

MD5
90bb49f3fd416f912a637526914bd044

SHA1
626051dd6c759a5b847664549736c37aba9ede5a

SHA256
1f8e8f336df6773d6b63bd5a7efbfc889d08888fec55da402eaf93cb950aa283

SHA512
5156923f51be2057f7003577b46732f6b0b0bb55402f49df3747085b9802b3a2492cd5f087ef988db5a69f241c10163ada0e649b149da8a198b7fc2cc83334e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6DAF.tmp\ioSpecial.ini

Filesize
996B

MD5
fc748a9f0b0716c34c9a791d4ebc42a0

SHA1
ef3d1fda5c0160657d299143f05fe38c096beefd

SHA256
297092e42d661baabd58466167ba796a324e8dd33ae0ae96449187b21152a5b9

SHA512
595c4cc391efa3195859ffeec72404ee781e349d9e66d1235fdf9d8603ea023f8fdaf25a7ca7fd22e63827d89e1e5e85952e09a52715adb81d8b2c5fbe8f22fd

Download Submit