f64de4aee0bc21db63da573ccb97b7d9a8d1e8dfc29bef72d8c8f26c4ec640cc

Analysis

max time kernel
91s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/ditu.exe
Size 76KB
Sample240203-edmf8sgdc9
SHA256 d898a5e9c00c3e3ce32fb308e60458bc97941db241ced9cdd9dc94ae74134fcb
MD5 2b0a1ef1e4315602d529aee1e480d4d9
SHA1 609a9c6fe4f11db446ba307f8ce681b95dfdbb93
SHA512 795c8c3d0afdf2b4541a2dbabd7d9ac85ad45eb718ed52f75c13e9aa92b6cfd1d32153f9ba9eb10c96683ea16c0424b45e5658ffd89749bd6b6f9455a6e73cb8
SSDEEP 1536:RjLaMv3xnCwNz0DxkJVw/Z4RoncXfE8wOS6ineUjJPZzBq+2NUBl:ZeYBCwqDxkJVU43XONJ/B2u
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1380	ditu.exe
1380	ditu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\$TEMP\ditu.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\ditu.exe"
1⤵
- Loads dropped DLL
PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nss4E5F.tmp\InstallOptions.dll
Size 12KB
SHA256 435baf3b7282c9110697a4916834ef9371dd29fae6b4cb8e19c19eb126562dc9
MD5 08c82a46416a5e2b471d457968f53816
SHA1 3e3897c20b9e89b279b4764a633f67955bf8f09a
SHA512 91e2055b91d04b2348a923cb298ac6ba3637de5038dc4f849c4d2f1665d17de9cd6eb6a97d42d0f894d65348c8fd8e79cd61b667ea5a78e8960347e8cc8db81d
SSDEEP 384:PKlm7i+c3QW6ckPhyDEaLni2bbBBIXwZ:Sqi8BcyhEhLPbbTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nss4E5F.tmp\System.dll
Size 10KB
SHA256 af15ef6479e5ac5752d139d1c477ec02def9077df897dadc8297005b3fc4999d
MD5 61151aff8c92ca17b3fab51ce1ca7156
SHA1 68a02015863c2877a20c27da45704028dbaa7eff
SHA512 4f5c943b7058910dc635bdcfadfea1d369c3d645239d1a52b030c21f43aac8e76549e52fd28e38ba5341d32aefe3c090dd8377d9e105ad77f71ab8870d8e326e
SSDEEP 192:2OShJI/rmOAIPkWpUybQ9WhP4t5Rwc89XbubZaX5:n6OAOkWWycGP4XRwc2qFaX5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nss4E5F.tmp\ioSpecial.ini
Size 733B
SHA256 92e1c4f9490b7679d66ac85bf341824198fe43a5a254b445182140bc3cbeb371
MD5 8d02c44b612f31abfa7f903d34cc4d9a
SHA1 b408fb1cea9f1e5739330801221ca524d5abde6b
SHA512 38475153b1221908047dd8060cc40f07a64d4de8c4c4c32dfbc207df1737f5dca4998c97db9cf83e13ee02f69f1217ac387f2261cadf263c74a8da4633e56ae4
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nss4E5F.tmp\ioSpecial.ini
Size 785B
SHA256 15e2c98ac436c56e464e3101370cd8df21d1323756a1a141a6f8b1b42e59a4f7
MD5 53cd0b478f5a8d0c4582e72058a3508f
SHA1 2e69fc497d558fe449521c548b8e95602712d9a8
SHA512 5fcf1226307b9954098bd8e07157dc09e2fe00c5dfdd5cf52e9537d634b1309d8b3cfc220503b1aa82d5d9d50e5b500f7bfe6f255c3d04455bc559ff617244fc
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads