419d2a2ba2f5fd21f58c6eed964412b00e8b2bf1097c2c68f803a9336fcb0fc1

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8dea71c873cb0a6c9a6792553254846e.exe
Size

3.3MB
MD5

8dea71c873cb0a6c9a6792553254846e
SHA1

6bc9a90e5c9ed5310d895674bbc23bf0fe939d06
SHA256

419d2a2ba2f5fd21f58c6eed964412b00e8b2bf1097c2c68f803a9336fcb0fc1
SHA512

2e73ce21082d299fbc51c2916a4e2e745b5dbcebc75e589cdf785510dc829801b662cfc3b1245a336a88c1d4e30104d4d4fe0b6da485cc005157cbd401942eb1
SSDEEP

49152:39Eqr58vFf+4jWMC50tCP36RktzuuTT+pwsdPd5XDv1TDIkXSWa6KPkwgmPm4GtR:iquvK1GtCPRhTT+xdPdlr1/nU9kwRLEj

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4776	8dea71c873cb0a6c9a6792553254846e.exe
4776	8dea71c873cb0a6c9a6792553254846e.exe
4776	8dea71c873cb0a6c9a6792553254846e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4776	8dea71c873cb0a6c9a6792553254846e.exe
4776	8dea71c873cb0a6c9a6792553254846e.exe

C:\Users\Admin\AppData\Local\Temp\8dea71c873cb0a6c9a6792553254846e.exe
"C:\Users\Admin\AppData\Local\Temp\8dea71c873cb0a6c9a6792553254846e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsl4875.tmp\tools.dll

Filesize
236KB

MD5
e12f05661436f2974cf91b5fc76fb5f4

SHA1
5e0b7887950204713bef3da0018911279f2540ec

SHA256
1873de723938193f9f0877b08c160884b79503b6607598158ad99bd909189fdc

SHA512
61d42e055865dd98552b29dd69dc3d761bc7f77c1af108ad13b0b390059be5668657645258c0c08052a5fe1e9f6bdb018da136eb103b7335097487ec0de5d22d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl4875.tmp\tools.dll

Filesize
125KB

MD5
dd1f2e1d1bc7432ac1c3e36fad3bc407

SHA1
aba75a4931fcca74a95f37ce3e68d2c06da98564

SHA256
1661be9835335dfc2bbcc345093a52dd407ec480b86bce62b796f1f08031a986

SHA512
2a58883c3e87efccc64d16d57c381770125b565c79cd9f86383d0e219bf8cc887533445083aeca9d5e5a29774a2ca0d8d84fbb4f63d677da65a15d6f9467d38d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl4875.tmp\tools.dll

Filesize
172KB

MD5
7fcd60968e56965d5b157fae80be3e1f

SHA1
62cde9a676dc9d76bb762e497601f2768056388c

SHA256
be1d3bb3d0259dd7d2a037b125896895e4573115706e7580983a375d2784ec20

SHA512
de54227142955c1cf72da40b641870c5666de9c5013f42b5f30e218aa218afdbfd9c24923f5663acac41fd9c3973f1ef97a899cf16a315010722237cb16ace99

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl4875.tmp\tools.dll

Filesize
191KB

MD5
1e7506c759f856a0e089bb7a5251286b

SHA1
f9220e5ed28777d86208026e1ff206ff3ea081e3

SHA256
1e875f3463a54957cddafc5d9beb45754b52a6ebfc97c619657ee89c1d2f83e8

SHA512
48a13162688567ce718f62652abf2dbdc061167bd911f3d8051872a7916b822b32c224ed104a401e678e0be344726692faaf45499c9ac7bc739e971307d8ff80

Download Submit
memory/4776-28-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/4776-23-0x0000000073C40000-0x00000000741F1000-memory.dmp

Filesize
5.7MB

Download
memory/4776-24-0x0000000073C40000-0x00000000741F1000-memory.dmp

Filesize
5.7MB

Download
memory/4776-26-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/4776-19-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/4776-29-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/4776-30-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/4776-32-0x0000000073C40000-0x00000000741F1000-memory.dmp

Filesize
5.7MB

Download
memory/4776-31-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/4776-33-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/4776-34-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/4776-35-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/4776-36-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download