2062cec7ae097ed057248c74fce3c5ca9111a8ac46ec3620f3f0f27abc78a9ff

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78c68612c91f659aba2f353ee9be8d4d.exe
Size

142KB
MD5

78c68612c91f659aba2f353ee9be8d4d
SHA1

8b541e06d8020cfe0e7193fb4e2c01b9a063a8ea
SHA256

2062cec7ae097ed057248c74fce3c5ca9111a8ac46ec3620f3f0f27abc78a9ff
SHA512

78c21ff07642f52ec4594de353588ce8e47cff22e4049203254810de7a9c94f1e70af2b08cafeccdd3d898e4307d17cce8c15bc7a756647d500144303f2f44f4
SSDEEP

3072:z7227BlmdTT5uXHCeLju1t41K6uO/lDPkyjpGEJ:v7fmdTU3CW44lDcyQEJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2352	681e162e.exe

Loads dropped DLL 3 IoCs

pid	Process
2324	78c68612c91f659aba2f353ee9be8d4d.exe
2324	78c68612c91f659aba2f353ee9be8d4d.exe
2352	681e162e.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\9af74641.dll	78c68612c91f659aba2f353ee9be8d4d.exe
File opened for modification	C:\Windows\SysWOW64\9af74641.dll	78c68612c91f659aba2f353ee9be8d4d.exe
File created	C:\Windows\SysWOW64\BASSMOD.dll	681e162e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2352	2324	78c68612c91f659aba2f353ee9be8d4d.exe	28
PID 2324 wrote to memory of 2352	2324	78c68612c91f659aba2f353ee9be8d4d.exe	28
PID 2324 wrote to memory of 2352	2324	78c68612c91f659aba2f353ee9be8d4d.exe	28
PID 2324 wrote to memory of 2352	2324	78c68612c91f659aba2f353ee9be8d4d.exe	28

C:\Users\Admin\AppData\Local\Temp\78c68612c91f659aba2f353ee9be8d4d.exe
"C:\Users\Admin\AppData\Local\Temp\78c68612c91f659aba2f353ee9be8d4d.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\681e162e.exe
  "C:\Users\Admin\AppData\Local\Temp\681e162e.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\681e162e.exe

Filesize
45KB

MD5
d9dbeac7f4760554f51504b9b308976e

SHA1
ea12a7ce3929e0bc088da2dc58e50860cab1acc6

SHA256
844747f8c2b141ed12c2dcb3a8ccf3aa2f7f0aa108bbfdfbcdd82d4909ca2bd0

SHA512
9bdd4aa81c96c695f1314904fc3124ce1ac53f1674e4a60f696c18e907117dc21f27e07dde90301b60975eb4a3689416d904d91d6e638b7342aa06a9fb2fed3c

Download Submit
\Windows\SysWOW64\BASSMOD.dll

Filesize
15KB

MD5
048c336274723710201a3ab5ce7af260

SHA1
c72d1d72b9cc49e11fa3d2cd3d9366bc9be19277

SHA256
454deb7962edbeb3260decec8b51a8c2febb9226ebaf627859c02f455af5bcd3

SHA512
acd01168b04dd528f583239cc9b2ddf6411a74da0da8e4ab332a8d03cd32381cbf8931e13e027f4a69c0a1a4abe8472f163d33f03b22b76df7d2ef66ad9c7c95

Download Submit
memory/2324-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2324-7-0x0000000000580000-0x000000000058E000-memory.dmp

Filesize
56KB

Download
memory/2324-12-0x0000000000580000-0x000000000058E000-memory.dmp

Filesize
56KB

Download
memory/2324-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2324-18-0x0000000000580000-0x000000000058E000-memory.dmp

Filesize
56KB

Download
memory/2324-19-0x0000000000580000-0x000000000058E000-memory.dmp

Filesize
56KB

Download
memory/2352-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download