9b1b74a00071c9effdc89a20141bac2a6d8e33486e634a9074638817e02cc639

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8d01d3f47fe411cc98d37ddded1b5d5d.exe
Size

929KB
MD5

8d01d3f47fe411cc98d37ddded1b5d5d
SHA1

618edcc50da3e2ecfed849028b129b1468faba36
SHA256

9b1b74a00071c9effdc89a20141bac2a6d8e33486e634a9074638817e02cc639
SHA512

914ecfbe3181c5a3610f1505e0e1ddaa5690185826c157b0ae9c487f4ea263e94c1bef4f44155b515b51abc98380d831f2f9205fdad9634d001f5f4a407d9a41
SSDEEP

24576:00bbvjiJ1vOUqgZSQKh5q1B+EChdWCJ4CsnfZz9Q:rbz+MUkD7q1BmahCsnfZhQ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2696	28PKYE.exe
2768	35G7E

Loads dropped DLL 3 IoCs

pid	Process
1568	8d01d3f47fe411cc98d37ddded1b5d5d.exe
1568	8d01d3f47fe411cc98d37ddded1b5d5d.exe
1568	8d01d3f47fe411cc98d37ddded1b5d5d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2696	1568	8d01d3f47fe411cc98d37ddded1b5d5d.exe	29
PID 1568 wrote to memory of 2696	1568	8d01d3f47fe411cc98d37ddded1b5d5d.exe	29
PID 1568 wrote to memory of 2696	1568	8d01d3f47fe411cc98d37ddded1b5d5d.exe	29
PID 1568 wrote to memory of 2696	1568	8d01d3f47fe411cc98d37ddded1b5d5d.exe	29
PID 1568 wrote to memory of 2768	1568	8d01d3f47fe411cc98d37ddded1b5d5d.exe	28
PID 1568 wrote to memory of 2768	1568	8d01d3f47fe411cc98d37ddded1b5d5d.exe	28
PID 1568 wrote to memory of 2768	1568	8d01d3f47fe411cc98d37ddded1b5d5d.exe	28
PID 1568 wrote to memory of 2768	1568	8d01d3f47fe411cc98d37ddded1b5d5d.exe	28

C:\Users\Admin\AppData\Local\Temp\8d01d3f47fe411cc98d37ddded1b5d5d.exe
"C:\Users\Admin\AppData\Local\Temp\8d01d3f47fe411cc98d37ddded1b5d5d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Users\Admin\AppData\Local\Temp\35G7E
  "C:\Users\Admin\AppData\Local\Temp\35G7E"
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Users\Admin\AppData\Roaming\ZUIW66\28PKYE.exe
  "C:\Users\Admin\AppData\Roaming\ZUIW66\28PKYE.exe" -launcher
  2⤵
  - Executes dropped EXE
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ZUIW66\28PKYE.exe

Filesize
265KB

MD5
6e6a3aa91f29f7f7fab15399d937c6ba

SHA1
152747d0c5384e90287734b20339e6a900e263c8

SHA256
ecc1a6c604542c4535c783c77bb7975395ac5590987ad306baf57bfbfa9ca6c3

SHA512
2c7c4189ee90e239306b52ca2a54e16ce41c1052ddebada315fac32af624cdfc5708130ebee29a4b53501e242f825946ae8f34743070b3601dcda079905ef66a

Download Submit
C:\Users\Admin\AppData\Roaming\ZUIW66\28PKYE.exe.lnk

Filesize
792B

MD5
18c0a260b1b391ee2c39dc165a4f19f2

SHA1
675c1725011512c463ccda037c4aef8b5859cb80

SHA256
c22d70893b334f42bb050c3d8474bd31ee3d19d2b95b03e0fc3920ede3f4e0d9

SHA512
01e44d666a564bf11af662bd9315bef99fdf2fc4b0e5d84d5fea75e3e070e5a220848474735d1d6f9ad62bdd361f8e337fa6173798d7b3429a4cf2b6a87f5c4f

Download Submit
\Users\Admin\AppData\Local\Temp\35G7E

Filesize
664KB

MD5
f83c5018283e619f1de03dcab0d84a89

SHA1
ea207034796ca906dc52669071bb265c82f8eef3

SHA256
ee07222944b8a6006630d96aaa9972cd566c5786d777456d890fdb62d0f34f95

SHA512
86be9a5f47697996375e0027e6479820406f55f7027742bbe66f126c0ad30a0c61d70aa13780e82afc500bb453296a86100675dc4c1092acb6015d3ad77007c7

Download Submit
memory/1568-17-0x0000000000050000-0x0000000000090000-memory.dmp

Filesize
256KB

Download
memory/1568-0-0x0000000000250000-0x0000000000277000-memory.dmp

Filesize
156KB

Download
memory/1568-19-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download
memory/1568-20-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1568-16-0x0000000076EC0000-0x0000000076EC1000-memory.dmp

Filesize
4KB

Download
memory/1568-15-0x0000000000250000-0x0000000000277000-memory.dmp

Filesize
156KB

Download
memory/1568-52-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1568-55-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2696-41-0x00000000003A0000-0x00000000003C7000-memory.dmp

Filesize
156KB

Download
memory/2696-46-0x00000000003A0000-0x00000000003C7000-memory.dmp

Filesize
156KB

Download
memory/2696-50-0x0000000000050000-0x0000000000090000-memory.dmp

Filesize
256KB

Download
memory/2696-49-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2696-56-0x0000000000050000-0x0000000000090000-memory.dmp

Filesize
256KB

Download