dd6c069fe0815720736d50f4303de8aa23ec31b61035b69c43948f2d4a634499

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ac24949eff68e657491f13ceec8b0c6.exe
Size

39KB
MD5

2ac24949eff68e657491f13ceec8b0c6
SHA1

3338983176ff8747a1746c3899b6290095a3863f
SHA256

dd6c069fe0815720736d50f4303de8aa23ec31b61035b69c43948f2d4a634499
SHA512

0f2eab4e5fd2b1af7c9e1092e5c4ee5db8f81a121b659834d5da88ca7caa5f63ce19f3d31691440c582e2f1e03cd90dc0a44a66b42d5d888835b06dbc81c8bec
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PA4N:b/pYayGig5HjS3NPAG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2380	retln.exe

Loads dropped DLL 1 IoCs

pid	Process
1096	2ac24949eff68e657491f13ceec8b0c6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1096	2ac24949eff68e657491f13ceec8b0c6.exe
2380	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2380	1096	2ac24949eff68e657491f13ceec8b0c6.exe	28
PID 1096 wrote to memory of 2380	1096	2ac24949eff68e657491f13ceec8b0c6.exe	28
PID 1096 wrote to memory of 2380	1096	2ac24949eff68e657491f13ceec8b0c6.exe	28
PID 1096 wrote to memory of 2380	1096	2ac24949eff68e657491f13ceec8b0c6.exe	28

C:\Users\Admin\AppData\Local\Temp\2ac24949eff68e657491f13ceec8b0c6.exe
"C:\Users\Admin\AppData\Local\Temp\2ac24949eff68e657491f13ceec8b0c6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
39KB

MD5
49e4a36e8200a419cf012c12d18c4ea3

SHA1
643b4dd06645fa0afec2eff6ceddb31b7a21723e

SHA256
25b5bdc2f49d7a067cd136413b3fbdec9988163cc2ba72f884efc30ae43bca02

SHA512
0308b0ef8e7b9703811f1ff3e3b6ef970f7c3de529b70b18f9a110cdab8c0ea9e49c01b8b746db976d01461b07c4ebfa14290b60da09bef007326fc448b0e12b

Download Submit
memory/1096-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1096-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1096-5-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2380-16-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download