Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    23/01/2024, 19:00

General

  • Target

    7050c4053e466c58e67b0d8303f338ab.exe

  • Size

    875KB

  • MD5

    7050c4053e466c58e67b0d8303f338ab

  • SHA1

    20f11fa8bf3e890a110468c410716fa4f5c57884

  • SHA256

    14ef98932bc5fbb1c2ec62c2379757843edc781f4d5583eef14751874277ce0f

  • SHA512

    5be9aeb67d9ee64b461c4dd500d0a600e1641421e823399a1ca1e56aa6f0c77d65ead1f80ad222a24a88f226addafa7607e7e0942fa9bfc97bf29633ae278446

  • SSDEEP

    24576:BOMLKmtvPyHu7UtwdOy9pNg4W7HM8mcN+2QHCQX:QiKmHyO4tPp7s8LQB

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7050c4053e466c58e67b0d8303f338ab.exe
    "C:\Users\Admin\AppData\Local\Temp\7050c4053e466c58e67b0d8303f338ab.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Users\Admin\AppData\Local\Temp\7050c4053e466c58e67b0d8303f338ab.exe
      "C:\Users\Admin\AppData\Local\Temp\7050c4053e466c58e67b0d8303f338ab.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Users\Admin\AppData\Local\Temp\7050c4053e466c58e67b0d8303f338ab.exe
        "C:\Users\Admin\AppData\Local\Temp\7050c4053e466c58e67b0d8303f338ab.exe"
        3⤵
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\59Y23Md6kfbrgqxtGDG\extramod.dll

    Filesize

    73KB

    MD5

    6d07371fc32a05058d034e32afe5db83

    SHA1

    22023abeb6d829f409ecd3463d8034549239a49c

    SHA256

    1d9b3b58330262b04334986dd7748608ceb1f58641d6ce43c51d8663ed576385

    SHA512

    19e94370cc4a1da0aa80584ecb95a2ff5c839d71e33042f95dbbd8e40f1b991e90b9abe965aaf0d639a9ca3b73572ef004f8764407352e94935fe2e6ef226478

  • \Users\Admin\AppData\Local\Temp\59Y23Md6kfbrgqxtGDG\loading_screen.dll

    Filesize

    5KB

    MD5

    44dac7f87bdf94d553f8d2cf073d605d

    SHA1

    21bf5d714b9fcab32ba40ff7d36e48c378b67a06

    SHA256

    0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66

    SHA512

    92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

  • \Users\Admin\AppData\Local\Temp\59Y23Md6kfbrgqxtGDG\lua51.dll

    Filesize

    494KB

    MD5

    f0c59526f8186eadaf2171b8fd2967c1

    SHA1

    8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb

    SHA256

    6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6

    SHA512

    dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

  • \Users\Admin\AppData\Local\Temp\59Y23Md6kfbrgqxtGDG\shared_library.dll

    Filesize

    200KB

    MD5

    a865a0c4ff5e036a811cecadc527471e

    SHA1

    fabc08d74f38b79afbd07e0c426875d8d063996c

    SHA256

    9242243de3bfc8fa082b1d972699592afc76ca67bc69ff7fe6026f748feae63e

    SHA512

    bdcc2f150dd265ba5b8ad8a38fcbcde53a669308823bd4624cbad208e1c404c08a1426855dd230bbf95adc9d46e312c0470f7e90761aac265c1789d4099d9925

  • memory/2484-15-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

    Filesize

    64KB

  • memory/2484-13-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

    Filesize

    64KB

  • memory/2484-10-0x00000000002A0000-0x00000000002D6000-memory.dmp

    Filesize

    216KB

  • memory/2484-14-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

    Filesize

    64KB

  • memory/2484-17-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

    Filesize

    64KB

  • memory/2484-16-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

    Filesize

    64KB

  • memory/2484-18-0x000000007EF90000-0x000000007EFA0000-memory.dmp

    Filesize

    64KB

  • memory/2484-19-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

    Filesize

    64KB

  • memory/2484-5-0x00000000001E0000-0x00000000001F6000-memory.dmp

    Filesize

    88KB

  • memory/2484-25-0x000000007EF00000-0x000000007EF10000-memory.dmp

    Filesize

    64KB