343bcf3e6a6cfb2ba9011c8cb5215b4fe5c2f515734bef0979ee3d1de3c6e202

Analysis

max time kernel
139s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e15c2a7e5e20cc6bb0bf32d2feb1e76.exe
Size

340KB
MD5

7e15c2a7e5e20cc6bb0bf32d2feb1e76
SHA1

8dce20d57f4a5d9a4d21590526944a0746f9370b
SHA256

343bcf3e6a6cfb2ba9011c8cb5215b4fe5c2f515734bef0979ee3d1de3c6e202
SHA512

eab0b4014f81de7004a4768d5e38249fc00b44ab05134e5df725437037b65d0489c199f0ddc7edfd9b1dfa85d097301af1db4788fa7437b42945ca994aaea762
SSDEEP

6144:gbUTp1C9xSmUFgaooqYjbTVM+eB6KEzRa3pPB3EUUX6VweTLnXh4U:gIS9xSbzbTQcbRcEUUX6JLXN

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3980	7e15c2a7e5e20cc6bb0bf32d2feb1e76.exe
3980	7e15c2a7e5e20cc6bb0bf32d2feb1e76.exe
3980	7e15c2a7e5e20cc6bb0bf32d2feb1e76.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\7e15c2a7e5e20cc6bb0bf32d2feb1e76.exe
"C:\Users\Admin\AppData\Local\Temp\7e15c2a7e5e20cc6bb0bf32d2feb1e76.exe"
1⤵
- Loads dropped DLL
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nscF09B.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscF09B.tmp\TBC.dll

Filesize
94KB

MD5
ec0281fd243bffbfe3cf1558e99b51fc

SHA1
2841c1e42a06d618db54dedc9a5aee48c1c9869a

SHA256
902ce26a56b68e18f4360c7b6a3221757377af06e9125bdaeed8f1290d999659

SHA512
a117af91d786ef824f0b0f978cbc15ebc098f6b57481888d97f0ce503ce39e4a6312cd51ffe32625cbe8c4d019f5b40a4d796608c22eeb95d97150c57080d99c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscF09B.tmp\nsDialogs.dll

Filesize
156KB

MD5
879ef35b34de9a94762cb32d26ae0db5

SHA1
a9754a70d9456d7b4292a67d44ccf53757ed70ce

SHA256
51480849fec0b57b872a9bf6992f8c98e6ceb79b318b09a48347f6d3e0bc416f

SHA512
9b373b04fdeef8b9f1cbdd7bf412990422497e437ae6fd0bcbe8ae7f8cf343161f4be200b3207960884c09558175157764f9af688c0cac53119db3ceff980ee2

Download Submit
memory/3980-18-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download