1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2024 18:30

Target

SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.exe
Size

15.7MB
MD5

c4f4a82eeac84a8a0f60996c2e796291
SHA1

5055cd3395e78cc91b563cfd1d2e96f652349851
SHA256

1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd
SHA512

6df3aa2d4cd26b9cb407353b918d49c3e71b7d94671c2a9514b9c1eebff02e12dfe2856bbd4f2d51291700a8900851f6cc9a1fb84dee94974542131359577fff
SSDEEP

393216:9rCac/7QOYZqCMMY2VuNtEOfQsHQ1vNVmy/bJubM:9rCac/7dYfMMQtTfI1vTmyDj

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.tmp

pid process

2628 SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2628	SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.exe

description	pid	process	target process
PID 1596 wrote to memory of 2628	1596	SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.exe	SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.tmp
PID 1596 wrote to memory of 2628	1596	SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.exe	SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.tmp
PID 1596 wrote to memory of 2628	1596	SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.exe	SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.tmp

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Users\Admin\AppData\Local\Temp\is-J97RB.tmp\SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.tmp
"C:\Users\Admin\AppData\Local\Temp\is-J97RB.tmp\SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.tmp" /SL5="$60210,16107430,53248,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.exe"
2⤵
- Executes dropped EXE
PID:2628

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\is-J97RB.tmp\SecuriteInfo.com.TScope.Trojan.Delf.20454.30116.tmp

Filesize
669KB

MD5
52950ac9e2b481453082f096120e355a

SHA1
159c09db1abcee9114b4f792ffba255c78a6e6c3

SHA256
25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd

SHA512
5b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba

Download Submit
memory/1596-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1596-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1596-15-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2628-7-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2628-16-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2628-19-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download