08563576ca859f28436fcc3e2d7c30f8573a007879825d5150eb47a73325299f

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74f4d21c3c646d1f2ed34b1b3c4486a9.exe
Size

48KB
MD5

74f4d21c3c646d1f2ed34b1b3c4486a9
SHA1

ef8c109f37c92cf22dc09ad4123fcf2595025450
SHA256

08563576ca859f28436fcc3e2d7c30f8573a007879825d5150eb47a73325299f
SHA512

4b1b366cba014025103d3b22b08abde33ebfe1e02282f45a0ab754f22d0e1fcffd453cefb9e752816eae5bca96003f49d884354781e8203f9b4fb1d6096ba366
SSDEEP

768:EyW1yBtObv0U/xwPp0EoooiYECG2nZF5sZVcmxa:24Bobv7aB0EooYEC3rUVcYa

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

zbhnd.exe

pid process

2312 zbhnd.exe
Loads dropped DLL 1 IoCs

Processes:

74f4d21c3c646d1f2ed34b1b3c4486a9.exe

pid process

2232 74f4d21c3c646d1f2ed34b1b3c4486a9.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2312	zbhnd.exe

pid	process
2232	74f4d21c3c646d1f2ed34b1b3c4486a9.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

74f4d21c3c646d1f2ed34b1b3c4486a9.exe

description	pid	process	target process
PID 2232 wrote to memory of 2312	2232	74f4d21c3c646d1f2ed34b1b3c4486a9.exe	zbhnd.exe
PID 2232 wrote to memory of 2312	2232	74f4d21c3c646d1f2ed34b1b3c4486a9.exe	zbhnd.exe
PID 2232 wrote to memory of 2312	2232	74f4d21c3c646d1f2ed34b1b3c4486a9.exe	zbhnd.exe
PID 2232 wrote to memory of 2312	2232	74f4d21c3c646d1f2ed34b1b3c4486a9.exe	zbhnd.exe

C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
"C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"
1⤵
- Executes dropped EXE
PID:2312

C:\Users\Admin\AppData\Local\Temp\74f4d21c3c646d1f2ed34b1b3c4486a9.exe
"C:\Users\Admin\AppData\Local\Temp\74f4d21c3c646d1f2ed34b1b3c4486a9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
Filesize
48KB

MD5
a7dd4ac4c22a3fa6c3bce3929c4562ee

SHA1
4be14292721390fb15e62637af50d4d497952aca

SHA256
0aedf2ff4f0e3de55b5868bd07adfc3eebd249a119d59fdbea1d9c7670fc2207

SHA512
91e6f083498180bd9acf40b3f2dfcad501a43c93e5af01e8913366722bff8a6287933bb68126d48b3c4c2175a56b8563c7bbedd40817a0b671ec0c8c23124d9b

Download Submit
memory/2232-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2232-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2312-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download