209113be716dd92ebbc8da1c9aa8bb22adfda1da32e168055f3a56b1ddc0bbd5

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70e3f778f52b04ad8bdb0354532a6a78.exe
Size

5.5MB
MD5

70e3f778f52b04ad8bdb0354532a6a78
SHA1

9b047fc3233d886b804b842a63b17f075359be13
SHA256

209113be716dd92ebbc8da1c9aa8bb22adfda1da32e168055f3a56b1ddc0bbd5
SHA512

d7709b671b4f656d25504f55de04906a95e7d092a817b61a19fd88c90a73b212e7ca7343f79ec8fcefecb4c45fec3ea27d00419985271e1b0b23e8e612e35e79
SSDEEP

98304:rcz+qTqq77LnD7juT++XNwdqqr+4ATkOGG25cyx8j2FBP2KJlykmKkPHbDgI:rcSkqELnnq/XCdqNdkOjyx82BeKqjKA1

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2260	70e3f778f52b04ad8bdb0354532a6a78.exe
2260	70e3f778f52b04ad8bdb0354532a6a78.exe
2260	70e3f778f52b04ad8bdb0354532a6a78.exe
2260	70e3f778f52b04ad8bdb0354532a6a78.exe
2260	70e3f778f52b04ad8bdb0354532a6a78.exe
2260	70e3f778f52b04ad8bdb0354532a6a78.exe
2260	70e3f778f52b04ad8bdb0354532a6a78.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2260	70e3f778f52b04ad8bdb0354532a6a78.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2260	70e3f778f52b04ad8bdb0354532a6a78.exe

C:\Users\Admin\AppData\Local\Temp\70e3f778f52b04ad8bdb0354532a6a78.exe
"C:\Users\Admin\AppData\Local\Temp\70e3f778f52b04ad8bdb0354532a6a78.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst4971.tmp\AdvSplash.dll

Filesize
5KB

MD5
41be2441ee7c684eaa76a62d4223b4c7

SHA1
05de8220e296db1025f7bd4d9de1f44370018162

SHA256
0990902460ec38bcd605b518bffa081942c6f4c5fe1828a61ba3965bbf15d8bd

SHA512
fec074a2196141e497334b57563dc7863a0b949d348164aec8c4f21d1b3c4ed795e03fd6e5726a2e90da7015abfbb4e28102647c0e343e84a707e99271a1a938

Download Submit
\Users\Admin\AppData\Local\Temp\nst4971.tmp\KillProcDLL.dll

Filesize
32KB

MD5
83142eac84475f4ca889c73f10d9c179

SHA1
dbe43c0de8ef881466bd74861b2e5b17598b5ce8

SHA256
ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

SHA512
1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

Download Submit
\Users\Admin\AppData\Local\Temp\nst4971.tmp\NSIS_HTTPRequest.dll

Filesize
55KB

MD5
52033e4f012b5ea9e6a2a719c5a9f2bf

SHA1
14ae0a9600997b77057a6c07bdf0ad974971fc01

SHA256
00b7b5c1addeb7404089cb44743701614717723397790a73a48118aecbc423b4

SHA512
d3101723c485a28d1871ca49656b19681a36cee459d061ba8a66a97ead9e5d87d635bee912ebbcd5d743f1d562d4dbe0952d97987b7016fd0a6f54dacbc95f45

Download Submit
\Users\Admin\AppData\Local\Temp\nst4971.tmp\System.dll

Filesize
11KB

MD5
959ea64598b9a3e494c00e8fa793be7e

SHA1
40f284a3b92c2f04b1038def79579d4b3d066ee0

SHA256
03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

SHA512
5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

Download Submit
\Users\Admin\AppData\Local\Temp\nst4971.tmp\UserInfo.dll

Filesize
4KB

MD5
d16e06c5de8fb8213a0464568ed9852f

SHA1
d063690dc0d2c824f714acb5c4bcede3aa193f03

SHA256
728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531

SHA512
60502bb65d91a1a895f38bd0f070738152af58ffa4ac80bac3954aa8aad9fda9666e773988cbd00ce4741d2454bf5f2e0474ce8ea18cfe863ec4c36d09d1e27a

Download Submit
\Users\Admin\AppData\Local\Temp\nst4971.tmp\nsDialogs.dll

Filesize
9KB

MD5
f7b92b78f1a00a872c8a38f40afa7d65

SHA1
872522498f69ad49270190c74cf3af28862057f2

SHA256
2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e

SHA512
3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79

Download Submit