f0258ca7b052d82aab6447d7feb1c640abff936b4c02df3a2e3d93c9c476f5f8

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73f3e81bcd66f7183d55366d2396328b.exe
Size

29.8MB
MD5

73f3e81bcd66f7183d55366d2396328b
SHA1

abe16e6f5471c65e7d099903ad2a895c4461174b
SHA256

f0258ca7b052d82aab6447d7feb1c640abff936b4c02df3a2e3d93c9c476f5f8
SHA512

e10f0d10605aae108ad6665c486f03ad84b646eee08651ba87490de04e6d64e464689ede8a61f4ae0ef1d1a901068bb1b62eba20f4520553a1208a70dcddd28c
SSDEEP

786432:n5u8ob3fF8LjmdPYYJLhsSSiBgUBk5kb9PegMK2WiFN0JBdUZN:szuP1YJVjBgIkK2h7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

73f3e81bcd66f7183d55366d2396328b.tmp

pid process

1984 73f3e81bcd66f7183d55366d2396328b.tmp
Loads dropped DLL 3 IoCs

Processes:

73f3e81bcd66f7183d55366d2396328b.exe73f3e81bcd66f7183d55366d2396328b.tmp

pid process

3060 73f3e81bcd66f7183d55366d2396328b.exe
1984 73f3e81bcd66f7183d55366d2396328b.tmp
1984 73f3e81bcd66f7183d55366d2396328b.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

73f3e81bcd66f7183d55366d2396328b.tmp

pid process

1984 73f3e81bcd66f7183d55366d2396328b.tmp

pid	process
1984	73f3e81bcd66f7183d55366d2396328b.tmp

pid	process
3060	73f3e81bcd66f7183d55366d2396328b.exe
1984	73f3e81bcd66f7183d55366d2396328b.tmp
1984	73f3e81bcd66f7183d55366d2396328b.tmp

pid	process
1984	73f3e81bcd66f7183d55366d2396328b.tmp

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

73f3e81bcd66f7183d55366d2396328b.exe

description	pid	process	target process
PID 3060 wrote to memory of 1984	3060	73f3e81bcd66f7183d55366d2396328b.exe	73f3e81bcd66f7183d55366d2396328b.tmp
PID 3060 wrote to memory of 1984	3060	73f3e81bcd66f7183d55366d2396328b.exe	73f3e81bcd66f7183d55366d2396328b.tmp
PID 3060 wrote to memory of 1984	3060	73f3e81bcd66f7183d55366d2396328b.exe	73f3e81bcd66f7183d55366d2396328b.tmp
PID 3060 wrote to memory of 1984	3060	73f3e81bcd66f7183d55366d2396328b.exe	73f3e81bcd66f7183d55366d2396328b.tmp
PID 3060 wrote to memory of 1984	3060	73f3e81bcd66f7183d55366d2396328b.exe	73f3e81bcd66f7183d55366d2396328b.tmp
PID 3060 wrote to memory of 1984	3060	73f3e81bcd66f7183d55366d2396328b.exe	73f3e81bcd66f7183d55366d2396328b.tmp
PID 3060 wrote to memory of 1984	3060	73f3e81bcd66f7183d55366d2396328b.exe	73f3e81bcd66f7183d55366d2396328b.tmp

C:\Users\Admin\AppData\Local\Temp\73f3e81bcd66f7183d55366d2396328b.exe
"C:\Users\Admin\AppData\Local\Temp\73f3e81bcd66f7183d55366d2396328b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060

C:\Users\Admin\AppData\Local\Temp\is-8D63M.tmp\73f3e81bcd66f7183d55366d2396328b.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8D63M.tmp\73f3e81bcd66f7183d55366d2396328b.tmp" /SL5="$70124,30955975,78848,C:\Users\Admin\AppData\Local\Temp\73f3e81bcd66f7183d55366d2396328b.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1984

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-8D63M.tmp\73f3e81bcd66f7183d55366d2396328b.tmp
Filesize
640KB

MD5
a3ea8af95e5e90b0e44ca287c8ce788c

SHA1
fd11ebe37b9deea90b9a64c7473d67d73338770a

SHA256
564a10b4d2a5238e754d6cfa807b45595dfbed53d124cd2f16101b9f5a4f9fc9

SHA512
c65ea6c1a3c5a2756864dbe8605ebd4476bfb535e2d5b11112e4f98b688b32a80f8ed0482adcb2ace05de815fcbd02e6c25fd055d8cce05d5e006eae0453d1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8D63M.tmp\73f3e81bcd66f7183d55366d2396328b.tmp
Filesize
254KB

MD5
551f7755f37f21ceb5e9ff2e339097a5

SHA1
b45bff5c4390c162fcfffc3ae128d39926ddcdcb

SHA256
b5512622487affe05331f04f5ed3f974027a7e650003cbe33fb7a07d4e4f039f

SHA512
915268318ef39180e66eb952037b57e904c8e71d3856f9cc483d7a42c8ee7a49009ea5c8a44e530763ab79870f4ce9a2669d60005df490e52a1fed27919bd38b

Download Submit
\Users\Admin\AppData\Local\Temp\is-8D63M.tmp\73f3e81bcd66f7183d55366d2396328b.tmp
Filesize
694KB

MD5
3c847fe463036a9ff1c87fa6d3b3d942

SHA1
31e694e7e32a5e984062144a2d3d720e3fe9a8e1

SHA256
512dedef0809ef27428506d896a58af5e3a00c5f813f18554bbda2989114bb58

SHA512
2bef21e2ffbd68c1169261fc9e317a25a765d614438863391ca94f0728fe79b4a74dc2612a3abb1b1e28d2ea35c4f7c8d9975f7764c6acd1c88ad4fb189c7058

Download Submit
\Users\Admin\AppData\Local\Temp\is-P0B7S.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1984-12-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1984-18-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1984-21-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3060-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3060-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3060-17-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download