cdbf38c8db64a678478ce5d6465285f6348bba7c5bffb8d0aacbb43b6c7f5b8a

Analysis

max time kernel
150s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b1bce489439538b1ca517b232e08596.exe
Size

84KB
MD5

8b1bce489439538b1ca517b232e08596
SHA1

c7dee42bc838f5030548ffb1ca614ab5cb046465
SHA256

cdbf38c8db64a678478ce5d6465285f6348bba7c5bffb8d0aacbb43b6c7f5b8a
SHA512

5258d98eaa424436e7eead8c9f55356646a776a13c99757664b50205f1a3afd62760d36235acaf2da1dc00c48e5fa4ade1f28865514af61830fb3bdda6971ac9
SSDEEP

1536:pLXB65939tY6HBg4sXJDxG213AuvWVvG5w4CPnNhI:pLk395hYXJwagG5wNW

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 53 IoCs

pid	Process
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe
640	8b1bce489439538b1ca517b232e08596.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ElSendero\autoUpdater.log	8b1bce489439538b1ca517b232e08596.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\8b1bce489439538b1ca517b232e08596.exe
"C:\Users\Admin\AppData\Local\Temp\8b1bce489439538b1ca517b232e08596.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsr58A0.tmp\inetc.dll

Filesize
24KB

MD5
1efbbf5a54eb145a1a422046fd8dfb2c

SHA1
ec4efd0a95bb72fd4cf47423647e33e5a3fddf26

SHA256
983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341

SHA512
7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr58A0.tmp\nsisFirewall.dll

Filesize
8KB

MD5
69f2e8c6fd141e9e720b2c4c366a8154

SHA1
a6279d93a102b6d7608dced32a36ddcd3e51994c

SHA256
2e204ee4f1d12b4ca35c8205cea0cabe354f2e79a471863cfb76a7cee83cf107

SHA512
bf23a5f3ce98e6a1c04fe8ae6b6f385483ceed62470cd109017c97f37c23adbf0203bfb43d09b007c6925aeb5da9617f33bc5c478618f00cc91da83a48cacaf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr58A0.tmp\nsislog.dll

Filesize
42KB

MD5
e47100b70748fc790ffe6299cdf7ef2d

SHA1
ad2a9cd5f7c39121926b7c131816e7ba85aeead2

SHA256
271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

SHA512
88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

Download Submit
memory/640-96-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/640-123-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/640-30-0x0000000002220000-0x0000000002230000-memory.dmp

Filesize
64KB

Download
memory/640-48-0x0000000003050000-0x0000000003060000-memory.dmp

Filesize
64KB

Download
memory/640-58-0x0000000003050000-0x0000000003060000-memory.dmp

Filesize
64KB

Download
memory/640-81-0x0000000003050000-0x0000000003060000-memory.dmp

Filesize
64KB

Download
memory/640-86-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/640-5-0x0000000002220000-0x0000000002230000-memory.dmp

Filesize
64KB

Download
memory/640-115-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/640-38-0x0000000002220000-0x0000000002230000-memory.dmp

Filesize
64KB

Download
memory/640-138-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/640-146-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/640-161-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/640-176-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/640-184-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/640-15-0x0000000002220000-0x0000000002230000-memory.dmp

Filesize
64KB

Download
memory/640-201-0x0000000000620000-0x0000000000630000-memory.dmp

Filesize
64KB

Download
memory/640-204-0x0000000000620000-0x0000000000630000-memory.dmp

Filesize
64KB

Download