f64de4aee0bc21db63da573ccb97b7d9a8d1e8dfc29bef72d8c8f26c4ec640cc

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/ditu.exe
Size 76KB
Sample240203-edmf8sgdc9
SHA256 d898a5e9c00c3e3ce32fb308e60458bc97941db241ced9cdd9dc94ae74134fcb
MD5 2b0a1ef1e4315602d529aee1e480d4d9
SHA1 609a9c6fe4f11db446ba307f8ce681b95dfdbb93
SHA512 795c8c3d0afdf2b4541a2dbabd7d9ac85ad45eb718ed52f75c13e9aa92b6cfd1d32153f9ba9eb10c96683ea16c0424b45e5658ffd89749bd6b6f9455a6e73cb8
SSDEEP 1536:RjLaMv3xnCwNz0DxkJVw/Z4RoncXfE8wOS6ineUjJPZzBq+2NUBl:ZeYBCwqDxkJVU43XONJ/B2u
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2508	ditu.exe
2508	ditu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2508	ditu.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\ditu.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\ditu.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nst7FFA.tmp\ioSpecial.ini
Size 733B
SHA256 64f0a0620d47c5295a9c9ddb938fd5cd161f304c62be7d882d656815be7987c1
MD5 150df8bbb1a689dcb9b6de641a2144da
SHA1 84acae06bf79acb2e3bdf633444abdacf4a4ad99
SHA512 3ce308fefae81f61cb315987811b05f2cc88d635356732a5ac33b3f931e6dd91f4bf333c348ed24886eda337624d90326ba3b81f02245b7ea2045fe518a65dca
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nst7FFA.tmp\ioSpecial.ini
Size 746B
SHA256 ad3561b7220d0f255e7bd94d36ad11dd4d905db4d8bef14dbd43c763d4443978
MD5 0e1ff0771635dce0823cde13b85bd21d
SHA1 6d773deeda14a683dceb7a3a090b5136ec3c695a
SHA512 32e917574abd3005dc38d0d472915e23fddb979f8bce969c1030588256591c0fec8c38885ca2732ff912756d55106a6e9c4cfda81f78ef80c15e13fe12ffb033
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path \Users\Admin\AppData\Local\Temp\nst7FFA.tmp\InstallOptions.dll
Size 12KB
SHA256 435baf3b7282c9110697a4916834ef9371dd29fae6b4cb8e19c19eb126562dc9
MD5 08c82a46416a5e2b471d457968f53816
SHA1 3e3897c20b9e89b279b4764a633f67955bf8f09a
SHA512 91e2055b91d04b2348a923cb298ac6ba3637de5038dc4f849c4d2f1665d17de9cd6eb6a97d42d0f894d65348c8fd8e79cd61b667ea5a78e8960347e8cc8db81d
SSDEEP 384:PKlm7i+c3QW6ckPhyDEaLni2bbBBIXwZ:Sqi8BcyhEhLPbbTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nst7FFA.tmp\System.dll
Size 10KB
SHA256 af15ef6479e5ac5752d139d1c477ec02def9077df897dadc8297005b3fc4999d
MD5 61151aff8c92ca17b3fab51ce1ca7156
SHA1 68a02015863c2877a20c27da45704028dbaa7eff
SHA512 4f5c943b7058910dc635bdcfadfea1d369c3d645239d1a52b030c21f43aac8e76549e52fd28e38ba5341d32aefe3c090dd8377d9e105ad77f71ab8870d8e326e
SSDEEP 192:2OShJI/rmOAIPkWpUybQ9WhP4t5Rwc89XbubZaX5:n6OAOkWWycGP4XRwc2qFaX5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads