Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 10:37
Static task
static1
Behavioral task
behavioral1
Sample
ts2_client_rc2_2032.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ts2_client_rc2_2032.exe
Resource
win10v2004-20240221-en
General
-
Target
ts2_client_rc2_2032.exe
-
Size
5.6MB
-
MD5
3c9d1bf8dfd3e257e536f0b87fbec00a
-
SHA1
666c23e4bf275d109475f03821790b9268f94ae0
-
SHA256
033db3bf5602914d750ec9d952d680c7845872c204850c82a1642f92bb81e7af
-
SHA512
1c80f85fff45cca979f6f86ac6db22d724e64b88c601f88297d0f83ec4644a3ec2da843c94f61bf5394842cecec083cb11720eb05ce75f5a1399ee6c459c3129
-
SSDEEP
98304:4VTuKO5b4dqD7mAQ6MLvCZwLr5STr6UdDJeYuQu7DaJI0KlAW1RwwLqRFnAj:ypOF4dyMTawYrf1nuT7yKlvROnm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4712 INS9F2E.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3760 wrote to memory of 4712 3760 ts2_client_rc2_2032.exe 92 PID 3760 wrote to memory of 4712 3760 ts2_client_rc2_2032.exe 92 PID 3760 wrote to memory of 4712 3760 ts2_client_rc2_2032.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\ts2_client_rc2_2032.exe"C:\Users\Admin\AppData\Local\Temp\ts2_client_rc2_2032.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\INS9F2E.tmpC:\Users\Admin\AppData\Local\Temp\INS9F2E.tmp /SL3 $501C8 C:\Users\Admin\AppData\Local\Temp\ts2_client_rc2_2032.exe 5845683 5849097 619522⤵
- Executes dropped EXE
PID:4712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
377KB
MD5ec2a3559ef793d976d3f72252ade0b68
SHA11673ad41b3683d9fde4e331ef97711af05c4c014
SHA256995ca25e8ac883429e67e2985887c2dc122e4d3cca48d6ab5b545e6a896ae2e1
SHA512a9f77b1735eb88e3ed790a0bb00637a616c33414cbb6f0b582322759a3bea3bf2fd7a334f92c17dd9f1669acdacc7551611ecedb80c11e999ddd120f104355b1