557c52ce5b2287387b843a22af6e4b84b200f67e4c869a7812f713b050d73f9a

Analysis

max time kernel
140s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7210e90869924eb8d652281e4a2c7cd8.exe
Size

840KB
MD5

7210e90869924eb8d652281e4a2c7cd8
SHA1

e6d3b51b68d67415cd2fc5fb8e9fe1b6be407e40
SHA256

557c52ce5b2287387b843a22af6e4b84b200f67e4c869a7812f713b050d73f9a
SHA512

fc730eac45eecc043466690aeeb04ba9fe5fb79444fc7fef6951fbbdeda1612e52e17069630c91e35d78039733625be768165565f8109a8ec58ade8794c18cf9
SSDEEP

24576:SiwRwU3UXu5Hs4BTqLVx3tHGkEPWlQN/XFXA7ui9wD:vHzosjZxdHGkEPWlC/XFXA0D

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe
3436	7210e90869924eb8d652281e4a2c7cd8.exe

C:\Users\Admin\AppData\Local\Temp\7210e90869924eb8d652281e4a2c7cd8.exe
"C:\Users\Admin\AppData\Local\Temp\7210e90869924eb8d652281e4a2c7cd8.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\DLLWaitForKillProgram.dll

Filesize
28KB

MD5
9c4b8ec42d89f7557bfd90798ce52787

SHA1
2376dde426ea65aa27c30e304086310605382475

SHA256
ed52bdad7b383a179b9b0e21fefdda2d72695c5263a815d5e1e0bfac6c718548

SHA512
17c12a27a08746755868558c037376dd7e20f03f0f71888c1329903b70975a54f57786c3c32bf88aaf30119f11ed978a6830ba91949e11cfc94fbb5ad95305b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\FILEDownPlug.dll

Filesize
20KB

MD5
b118053825642ecf3bba36500a70645b

SHA1
ce436f731bd8bf744399bf39e77f7bca5a4461af

SHA256
eb97c0e8d17986beb01c1366405c8fa70e5d69c5f82b30f184454a47c258fda5

SHA512
11e00d2e2fc6b85e96de5b9fd11ea3f1d681180879ac3c2a7cfbe35a3808466f8eaff70faa39d6f5739238a34558825a22f0887d5653df54305a3ccce3836c73

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\KillProcDLL.dll

Filesize
36KB

MD5
6958016193a066833556992077bad4fe

SHA1
5f564945936f99381d7e2408f034f97d069005a4

SHA256
f38c669c87f2a73768a27a01622690997e9d93d5ca3830b349bd24c3ff9f8d2e

SHA512
fd6ab5c341b331b80c940ba97a2cd14547c796933a2df26d3dd87ede1602b86d9f8c37baebd7dd4c68d811199fc96a27ad4cb995bb8889d51af91db9f43ba0a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\ioSpecial.ini

Filesize
603B

MD5
15c28e2ea8ca0b88365c80c5604028d8

SHA1
707ca188b7fa29add02455dd2c816d7770145a5f

SHA256
b07b50919a4abab9256bd67d845b7090a5426dc71d003de00e2c92ed823ad56f

SHA512
6f6372bf09fec622077f564c46a5a23bb1b7da4da5c7bdb3448ec795f33e679b29683085f353f905c5917ac28951314d2807e5481678ead3b044508e9c714cea

Download Submit