e1be7b23cd76177220b4e03cae44abe132ab153875d64f49f82c52bfc16cae61

Analysis

max time kernel
39s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20231215-de
resource tags

arch:x64arch:x86image:win10v2004-20231215-delocale:de-deos:windows10-2004-x64systemwindows
submitted
22/01/2024, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
best.exe
Size 900KB
Sample240122-dxltdafcdk
SHA256 e1be7b23cd76177220b4e03cae44abe132ab153875d64f49f82c52bfc16cae61
MD5 0e0e99a2c48c48746b45f597780256f4
SHA1 95eacaea9205b3a07c7a9a0c84c34c9702516c18
SHA512 a4ab510455a2aabc48b50238683f07a2ea7a60b8c0ddcf2da331691ec59dabba36db39e713a3494eaca7d51f5236aaf87228b802dbe88fea12cf74ab6064aa6c
SSDEEP 24576:b1xuZOWVgmqYiBLw7pAAINU/rqGGUIqpmyaXp2owCyXdIqIF:76VzCLO2xUjpmv2BCyX+
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2196	best.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\defencive\upspread.Blo	best.exe
File opened for modification	C:\Program Files (x86)\Common Files\abastral\Smrtenorers.Tra	best.exe
File opened for modification	C:\Program Files (x86)\Aarstidsbestemtes.ini	best.exe
File opened for modification	C:\Program Files (x86)\Common Files\eriko.ini	best.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Helpensions96.lnk	best.exe
File opened for modification	C:\Windows\Helpensions96.lnk	best.exe
File created	C:\Windows\resources\genbrugsanlgs.lnk	best.exe
File opened for modification	C:\Windows\Fonts\fanklubbernes\trningsdragternes.cal	best.exe
File opened for modification	C:\Windows\resources\genbrugsanlgs.lnk	best.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\best.exe
"C:\Users\Admin\AppData\Local\Temp\best.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eriko.ini

Path C:\Program Files (x86)\Common Files\eriko.ini
Size 39B
SHA256 3ff399ee4f579f7fa0182aa44664bd2031569645c2446353c0bc96dcff36f542
MD5 bc5af634a69648217fe164cc3e5662a4
SHA1 01a377d836bf64295484b3cdb681f2548575bb03
SHA512 2b84dae0cae3f061b689ec1f92606e6399bd553a4852b8ff1d6aaa640b6a2078672d180446f8fcc301490f74cf240e8b696ff4a547fd1ff56b5612b0d3b319e2
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa2B82.tmp\System.dll
Size 12KB
SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
MD5 SHA1 SHA512 SSDEEP