26f577e37ae6ea65acf5f454c439fd7adcd0491380bdc683ae84d34e654ea9b9

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a000bb220b57349cb25db153b3134bb.exe
Size

12.1MB
MD5

2a000bb220b57349cb25db153b3134bb
SHA1

30bec935053b18834ea182d6629b83b163a2835a
SHA256

26f577e37ae6ea65acf5f454c439fd7adcd0491380bdc683ae84d34e654ea9b9
SHA512

2d9933cd8da54a7f90e77f80039a64339d18b8087c18021d8699265b2e60247da45862b26a3dc66dbb7b75a5626f38a1917320b5c529ecd4b81a284e73caf517
SSDEEP

393216:ckaZIQhftMAb0VaZMKqRttuiEyJhxuuGNxgUFQo:ckai2ftvb0s+1lEMhmN1F9

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1364	2a000bb220b57349cb25db153b3134bb.exe
1364	2a000bb220b57349cb25db153b3134bb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1364	2a000bb220b57349cb25db153b3134bb.exe

C:\Users\Admin\AppData\Local\Temp\2a000bb220b57349cb25db153b3134bb.exe
"C:\Users\Admin\AppData\Local\Temp\2a000bb220b57349cb25db153b3134bb.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd49FD.tmp\ioSpecial.ini

Filesize
689B

MD5
d12a5b6e55b274a7510b4ff486591de8

SHA1
4ae28f7a8ddd7d223e066187a6926d20f0d38b93

SHA256
6a17ebbc12081e42443725b2d5c22bb8e4f84cab941430044f382f62e97f83bf

SHA512
9b0c144d270c5466d04edd37588a0e7675cfae77f0abc176910870c714ac76a7d90de026ef54858e85cdf8ca93b32c96b4c6eb4cbb95acc714e9db6e2b9d817d

Download Submit
\Users\Admin\AppData\Local\Temp\nsd49FD.tmp\InstallOptions.dll

Filesize
14KB

MD5
2a03c4a7ac5ee5e0e0a683949f70971b

SHA1
3bd9877caaea4804c0400420494ad1143179dcec

SHA256
d4f0042d8e7622b7e14395e926dd02edab3cdc77e82d88108b67a4d2cee9229b

SHA512
1942cdb522859f8dba46824786e361794a62e6201279201e1e0e2e07499fb6252933c5661782fccd77291c3650cafb2a7a08eee5431c8238f0da44840ee4c476

Download Submit
\Users\Admin\AppData\Local\Temp\nsd49FD.tmp\LangDLL.dll

Filesize
5KB

MD5
ebd0da54db9f12ffd15206cc24355793

SHA1
910be3bebdde55eb1ce05915a79f01ebdc622786

SHA256
4066a0cbd9f6bb13c0f6fb064d4647ef7bc68a1be3d0caa4460b5ffd9ed1e0e6

SHA512
cee09db96267b1a30477ff074988606bdf35f9a5aa798a9a10029b11c0c347ab42a124320d777acde458828954cc8cf1a489b1673b31d589cdc4f50d4b86659d

Download Submit