247a1537eb82f6b97c6a05fb3eab3311e28e3d2f33bead4f2573bf5c9bcc09b5

Analysis

max time kernel
132s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e0963e05443e34b41d580af4c18230d.exe
Size

1.7MB
MD5

8e0963e05443e34b41d580af4c18230d
SHA1

a0858db299141938cf34963ab8c9c7c2d7a208a1
SHA256

247a1537eb82f6b97c6a05fb3eab3311e28e3d2f33bead4f2573bf5c9bcc09b5
SHA512

818c069ff4188f4d99a158f691dc1de434e36dfefdc245f49ac5e0674569d8596f29f56b500b4d0c6889a17ad8dfd4fe24032a7a980285bcbb390069fbedeb14
SSDEEP

24576:j6Oa7Irvg8ThyxkndmRWGAWvYRaZaUWqq1htP/hXsdYKDnSb1VCL31DLC88hFDG:MIfTIedIWasaZdWqq1hmTnSbeLt

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3724	8e0963e05443e34b41d580af4c18230d.exe
3724	8e0963e05443e34b41d580af4c18230d.exe
3724	8e0963e05443e34b41d580af4c18230d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3724	8e0963e05443e34b41d580af4c18230d.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3724	8e0963e05443e34b41d580af4c18230d.exe

C:\Users\Admin\AppData\Local\Temp\8e0963e05443e34b41d580af4c18230d.exe
"C:\Users\Admin\AppData\Local\Temp\8e0963e05443e34b41d580af4c18230d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsp475B.tmp\BDMSkin.dll

Filesize
1.3MB

MD5
b540a866191f7fd20f5e6355bc2b094e

SHA1
df01a0c011e88a1f860db41d474d3fe893f06082

SHA256
ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

SHA512
e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp475B.tmp\tmp6x7zro.dll

Filesize
644KB

MD5
fa74c2c0fd23d41d34c062805047ee39

SHA1
678c20736ade6dcc1cc616505029f6c21c1a8695

SHA256
49e3b0944dfcf3426c8b3df1b889c7c90218082481957c29f29551589a839e6d

SHA512
0014ad7f9f880b14c2a4593bac4e6b5435be93d99a7a0c191c2b3894a309575d6bb0ead765cb8b7646d43ac5479cb06d491b75a35505da18d822521ddd280a0f

Download Submit
memory/3724-13-0x0000000003180000-0x00000000032C3000-memory.dmp

Filesize
1.3MB

Download